CVE-2024-29976

2024-06-0402:15:49

CWE-269

[email protected]

web.nvd.nist.gov

cve-2024-29976

security vulnerability

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

18.2%

JSON

UNSUPPORTED WHEN ASSIGNED
The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NAS326 firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "< V5.21(AAZF.17)C0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NAS542 firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "< V5.21(ABAG.14)C0"
      }
    ]
  }
]