CVE-2024-29976

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29976
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
Configurations

No configuration.

History

04 Jun 2024, 16:57

Type Values Removed Values Added
Summary
  • (es) ** NO SOPORTADO CUANDO SE ASIGNÓ ** La vulnerabilidad de administración de privilegios inadecuada en el comando “show_allsessions” en las versiones de firmware Zyxel NAS326 anteriores a V5.21(AAZF.17)C0 y versiones de firmware NAS542 anteriores a V5.21(ABAG.14)C0 podría permitir una atacante autenticado para obtener información de la sesión de un administrador que ha iniciado sesión y que contiene cookies en un dispositivo afectado.

04 Jun 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-04 02:15

Updated : 2024-06-06 16:15

NVD link : CVE-2024-29976

Mitre link : CVE-2024-29976

CVE.ORG link : CVE-2024-29976

JSON object : View

Products Affected

No product.

CWE
CWE-269

Improper Privilege Management