CVE-2024-29974: Zyxel NAS326 Firmware RCE Vulnerability

CVE-2024-29974 Overview

CVE-2024-29974 is a critical remote code execution vulnerability in the file_upload-cgi CGI program found in Zyxel NAS326 and NAS542 network-attached storage devices. The vulnerability allows an unauthenticated attacker to execute arbitrary code on vulnerable devices by uploading a specially crafted configuration file. This flaw was discovered in firmware versions that have since reached end-of-support status, making this particularly dangerous for organizations still running legacy Zyxel NAS equipment.

Critical Impact

Unauthenticated remote code execution allows attackers to fully compromise Zyxel NAS devices, potentially leading to data theft, ransomware deployment, or use as a pivot point for lateral movement within the network.

Affected Products

• Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0
• Zyxel NAS542 firmware versions before V5.21(ABAG.14)C0
• Zyxel NAS326 hardware devices
• Zyxel NAS542 hardware devices

Discovery Timeline

• 2024-06-04 - CVE-2024-29974 published to NVD
• 2025-01-22 - Last updated in NVD database

Technical Details for CVE-2024-29974

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The file_upload-cgi CGI program in affected Zyxel NAS firmware fails to properly validate uploaded configuration files, allowing attackers to bypass security controls and upload malicious content. Since the vulnerability can be exploited without authentication, any internet-exposed Zyxel NAS device running vulnerable firmware is at immediate risk.

The vulnerability is particularly concerning given that these products have been marked as unsupported by Zyxel, meaning many devices in the field may never receive patches. Network-attached storage devices are attractive targets for attackers due to their always-on nature and the sensitive data they typically contain.

Root Cause

The root cause of CVE-2024-29974 lies in insufficient validation of uploaded files within the file_upload-cgi CGI program. The application fails to properly verify the content type and structure of configuration files before processing them, allowing attackers to inject executable code disguised as legitimate configuration data. This represents a classic unrestricted file upload vulnerability where server-side validation is either missing or easily bypassed.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a vulnerable Zyxel NAS device exposed to the network
2. Crafting a malicious configuration file containing arbitrary code
3. Uploading the crafted file through the file_upload-cgi endpoint
4. Triggering execution of the embedded malicious code

The vulnerability mechanism involves exploiting the insufficient validation in the file upload CGI handler. When a crafted configuration file is submitted to the vulnerable endpoint, the server processes it without adequate security checks, allowing the attacker's payload to be written to the filesystem and subsequently executed. For detailed technical information, refer to the Outpost24 Blog on Zyxel Vulnerabilities and the Zyxel Security Advisory.

Detection Methods for CVE-2024-29974

Indicators of Compromise

• Unexpected HTTP POST requests to /cgi-bin/file_upload-cgi or similar upload endpoints on NAS devices
• Anomalous configuration file modifications or unexpected files in system directories
• Unusual outbound network connections from NAS devices to unknown external hosts
• Unexpected processes or services running on NAS devices
• Web server logs showing repeated access attempts to CGI endpoints from external IP addresses

Detection Strategies

• Monitor network traffic for unusual HTTP requests targeting Zyxel NAS CGI endpoints, particularly file upload operations
• Implement file integrity monitoring on NAS devices to detect unauthorized changes to system files or configurations
• Deploy network intrusion detection systems (IDS) with signatures for known Zyxel NAS exploitation patterns
• Review web server access logs for suspicious POST requests to /cgi-bin/ directories

Monitoring Recommendations

• Configure SIEM alerts for any authentication failures or unusual access patterns on NAS management interfaces
• Implement network segmentation monitoring to detect lateral movement from compromised NAS devices
• Enable verbose logging on Zyxel NAS devices and forward logs to a central collection point
• Monitor for DNS queries or network connections to known malicious infrastructure from NAS device IP addresses

How to Mitigate CVE-2024-29974

Immediate Actions Required

• Immediately upgrade Zyxel NAS326 firmware to version V5.21(AAZF.17)C0 or later
• Immediately upgrade Zyxel NAS542 firmware to version V5.21(ABAG.14)C0 or later
• If firmware updates are not possible, isolate vulnerable NAS devices from internet access immediately
• Conduct a thorough review of device logs to identify any signs of previous exploitation
• Consider replacing end-of-life NAS devices with currently supported models

Patch Information

Zyxel has released firmware updates to address this vulnerability. However, it is important to note that these products were marked as "UNSUPPORTED WHEN ASSIGNED," indicating they may have reached end-of-life status. Organizations should review the Zyxel Security Advisory for NAS Products for official patch information and guidance. Given the availability of proof-of-concept exploits, patching should be considered urgent.

Workarounds

• Block external access to Zyxel NAS devices by placing them behind a properly configured firewall
• Disable remote management interfaces and restrict access to trusted internal networks only
• Implement network segmentation to isolate NAS devices from critical systems and limit potential blast radius
• Use a VPN for any required remote access to NAS devices rather than exposing them directly to the internet
• Apply web application firewall (WAF) rules to block suspicious requests to CGI endpoints if direct patching is not immediately possible

# Example firewall rule to block external access to NAS CGI endpoints
# Adjust interface and IP ranges according to your environment
iptables -A INPUT -p tcp --dport 80 -i eth0 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -i eth0 -s ! 192.168.1.0/24 -j DROP