mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 01:02:25 +00:00
138 lines
4.2 KiB
JSON
138 lines
4.2 KiB
JSON
{
|
|
"id": "CVE-2024-6342",
|
|
"sourceIdentifier": "security@zyxel.com.tw",
|
|
"published": "2024-09-10T02:15:10.063",
|
|
"lastModified": "2025-01-22T22:31:48.667",
|
|
"vulnStatus": "Analyzed",
|
|
"cveTags": [
|
|
{
|
|
"sourceIdentifier": "security@zyxel.com.tw",
|
|
"tags": [
|
|
"unsupported-when-assigned"
|
|
]
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "**NO COMPATIBLE CUANDO SE ASIGN\u00d3** Una vulnerabilidad de inyecci\u00f3n de comandos en el programa export-cgi de las versiones de firmware Zyxel NAS326 hasta V5.21(AAZF.18)C0 y NAS542 hasta V5.21(ABAG.15)C0 podr\u00eda permitir que un atacante no autenticado ejecute algunos comandos del sistema operativo (OS) enviando una solicitud HTTP POST manipulada."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "security@zyxel.com.tw",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 5.9
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "security@zyxel.com.tw",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-78"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "5.21\\(aazf.18\\)c0",
|
|
"matchCriteriaId": "6FED14FF-5359-4B89-9E30-1E04AA255CBC"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:zyxel:nas326_firmware:5.21\\(aazf.18\\)c0:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "BEF2C82D-D13E-429A-9CF2-646F473C8DDF"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "E0A01B19-4A91-4FBC-8447-2E854346DAC5"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "5.21\\(abag.15\\)c0",
|
|
"matchCriteriaId": "D1D6A022-4710-4192-BC11-BDB841BA740C"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:zyxel:nas542_firmware:5.21\\(abag.15\\)c0:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "320C21DE-D9B2-464C-9079-1F32A6AFBA73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "31C4DD0F-28D0-4BF7-897B-5EEC32AA7277"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024",
|
|
"source": "security@zyxel.com.tw",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |