Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2024-29972 PoC — Zyxel NAS326和Zyxel NAS542 操作系统命令注入漏洞

Source
https://github.com/Pommaq/CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-poc
Associated Vulnerability
Title:Zyxel NAS326和Zyxel NAS542 操作系统命令注入漏洞 (CVE-2024-29972)
Description:** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Description
This is a proof of concept for the Zyxel vulnerabilities I found. Read the blog :)
File Snapshot

 [4.0K]  /data/pocs/509cb946f51bde63b85d7aabc4ec5d026f519263
├── [ 535]  create_rom.sh
├── [1.3K]  create_tar_archive.sh
├── [9.2K]  exploit.py
├── [   0]  magic.rom
└── [  32]  requirements.txt

0 directories, 5 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →