Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2024-29972

CriticalPublished

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before...

Published: Jun 4, 2024
Updated: Aug 2, 2024
Assigning CNA: Zyxel
Evidence observed: Aug 8, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

89.3%

High · next 30 days

Percentile: 99.8%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Sources

CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-pocPoC
This is a proof of concept for the Zyxel vulnerabilities I found. Read the blog :)
CVE-2024-29972Exploit
Exploit script for CVE-2024-29972 Zyxel NAS backdoor account, combining with CVE-2024-29973 for unauthorized root access via NsaRescueAngel.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.