CVE-2024-29973: Zyxel NAS326 and NAS542 Unauthenticated Command Injection via setCookie

CVE-2024-29973 is a command-injection vulnerability (CWE-78) in the 'setCookie' HTTP parameter of Zyxel's NAS326 and NAS542 network-attached storage firmware: NVD's own advisory text is flagged 'UNSUPPORTED WHEN ASSIGNED' and states that an unauthenticated attacker can execute operating-system commands by sending a crafted HTTP POST request, and Zyxel's own PSIRT scored the flaw 9.8 (critical) on the CVSS v3.1 scale even though both affected models had already reached end-of-vulnerability-support; NVD has not yet published its own Primary CVSS score.

CVE-2024-29973 (CWE-78, OS command injection) affects Zyxel's NAS326 and NAS542 network-attached storage devices. NVD's description is prefixed with the tag "** UNSUPPORTED WHEN ASSIGNED **" and states: "The command injection vulnerability in the "setCookie" parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request" (NVD).

Zyxel's own security advisory, covering multiple vulnerabilities in its NAS products, states that both the NAS326 (firmware V5.21(AAZF.16)C0 and earlier) and NAS542 (firmware V5.21(ABAG.13)C0 and earlier) had already reached end-of-vulnerability-support on 2023-12-31, before this fix was issued. Zyxel nonetheless released patched firmware — V5.21(AAZF.17)C0 for the NAS326 and V5.21(ABAG.14)C0 for the NAS542 — and credits Timothy Hjort of Outpost24 with reporting the command-injection flaw alongside four related CVEs disclosed in the same advisory (CVE-2024-29972, CVE-2024-29974, CVE-2024-29975 and CVE-2024-29976) (Zyxel security advisory for multiple vulnerabilities in NAS products).

NVD tracks CVE-2024-29973 with status "Analyzed" but records only Zyxel's own PSIRT-submitted score (source [email protected]) — CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — typed Secondary, not a Primary rating NVD has independently assigned itself, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, but FIRST scores the probability of exploitation at 0.86205 (99.7th percentile) as of 2026-11-07 — an exceptionally high EPSS score, notable because both affected models were already past their vendor-supported lifecycle when the patch shipped, meaning many deployed units may never be updated (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. Operators still running a Zyxel NAS326 or NAS542 should update to the patched firmware listed above even though the models are past their support window, or isolate the device from untrusted networks if an update is not possible.

• The command injection vulnerability in the 'setCookie' parameter in Zyxel NAS326 firmware before V5.21(AAZF.17)C0 and NAS542 firmware before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute OS commands via a crafted HTTP POST request. Description tagged 'UNSUPPORTED WHEN ASSIGNED.' — NVD
• NAS326 and NAS542 had reached end-of-vulnerability-support on 2023-12-31; patched firmware is V5.21(AAZF.17)C0 (NAS326) and V5.21(ABAG.14)C0 (NAS542); reported by Timothy Hjort of Outpost24 alongside four related CVEs (CVE-2024-29972, -29974, -29975, -29976). — Zyxel security advisory for multiple vulnerabilities in NAS products
• NVD status 'Analyzed' records only Zyxel's own Secondary CVSS v3.1 score of 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD-published Primary score as of this review. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.86205 (99.7th percentile) as of 2026-11-07. — FIRST EPSS