CVE-2024-29972

CriticalPublished

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before...

Published: Jun 4, 2024
Updated: Aug 2, 2024
Assigning CNA: Zyxel
Evidence observed: Aug 8, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

89.3%

High · next 30 days

Percentile: 99.8%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor AccountTemplate
http/cves/2024/CVE-2024-29972.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

CVE-2024-29972Exploit
Exploit script for CVE-2024-29972 Zyxel NAS backdoor account, combining with CVE-2024-29973 for unauthorized root access via NsaRescueAngel.
CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-pocPoC
This is a proof of concept for the Zyxel vulnerabilities I found. Read the blog :)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.