GCVE - cpe:2.3:o:zyxel:nas542_firmware:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:zyxel:nas542_firmware:-:*:*:*:*:*:*:*

part: o version: - update: *

Vendor	Zyxel (`d3fcf896-5708-55f8-8f74-3e19a9d55b89`)
Product	Nas542 Firmware (`5a0aaa33-30ab-58b5-8603-e49a711eaa52`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-29975`	vulnerable	2026-06-08 06:33:29.661282	Details available MEDIUM (6.7) UNSUPPORTED WHEN ASSIGNED The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device. Published: 2024-06-04T01:43:06.403Z Updated: 2024-08-02T01:17:58.589Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-29974`	vulnerable	2026-06-08 06:33:29.660592	Details available CRITICAL (9.8) UNSUPPORTED WHEN ASSIGNED The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device. Published: 2024-06-04T01:34:11.340Z Updated: 2024-08-02T01:17:58.668Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-29973`	vulnerable	2026-06-08 06:33:29.659603	Details available CRITICAL (9.8) UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request. Published: 2024-06-04T01:29:41.852Z Updated: 2024-08-02T01:17:58.484Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-29972`	vulnerable	2026-06-08 06:33:29.653185	Details available CRITICAL (9.8) UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request. Published: 2024-06-04T01:24:58.172Z Updated: 2024-08-02T01:17:58.671Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.