CVE-2024-29975

MediumPublished

** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before...

Published: Jun 4, 2024
Updated: Aug 2, 2024
Assigning CNA: Zyxel
Evidence observed: Aug 5, 2026

Primary CVSS

6.7/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

0.5%

Low · next 30 days

Percentile: 38.9%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.

Sources

CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-pocPoC
This is a proof of concept for the Zyxel vulnerabilities I found. Read the blog :)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.