mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
71 lines
2.4 KiB
JSON
71 lines
2.4 KiB
JSON
{
|
|
"id": "CVE-2024-29973",
|
|
"sourceIdentifier": "security@zyxel.com.tw",
|
|
"published": "2024-06-04T02:15:48.290",
|
|
"lastModified": "2024-08-02T02:15:17.533",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [
|
|
{
|
|
"sourceIdentifier": "security@zyxel.com.tw",
|
|
"tags": [
|
|
"unsupported-when-assigned"
|
|
]
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the \u201csetCookie\u201d parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before\u00a0V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "** NO SOPORTADO CUANDO S ASIGN\u00d3 ** La vulnerabilidad de inyecci\u00f3n de comando en el par\u00e1metro \u201csetCookie\u201d en las versiones de firmware Zyxel NAS326 anteriores a V5.21(AAZF.17)C0 y en las versiones de firmware NAS542 anteriores a V5.21(ABAG.14)C0 podr\u00eda permitir una atacante ejecutar algunos comandos del sistema operativo (SO) enviando una solicitud HTTP POST manipulada."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "security@zyxel.com.tw",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 5.9
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "security@zyxel.com.tw",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-78"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/",
|
|
"source": "security@zyxel.com.tw"
|
|
},
|
|
{
|
|
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024",
|
|
"source": "security@zyxel.com.tw"
|
|
}
|
|
]
|
|
} |