Zyxel Releases Patches for Firmware Vulnerabilities

Zyxel has released patches addressing command injection and remote code execution vulnerabilities in two NAS products that have reached end-of-vulnerability-support. Users are advised to install them for optimal protection.

Three out of five vulnerabilities could allow an unauthorized attacker to run operating system commands and arbitrary code on affected installations.

• Alert
• Vulnerabilities

CVE-2025-43859
Request Smuggling Vulnerability in Python’s h11 HTTP Library

By infosecbulletin / Sunday , April 27 2025

A critical vulnerability tracked as CVE-2025-43859 has been disclosed in h11, a minimalist, I/O-agnostic HTTP/1.1 protocol library written in Python....

Read More

• Alert
• Vulnerabilities

NVIDIA Releases Security Update For GPU Driver Vulnerabilities

By infosecbulletin / Saturday , April 26 2025

NVIDIA has released a software security update for its GPU Display Driver to fix multiple vulnerabilities affecting both the driver...

Read More

• Alert
• Cyber Attack
• Vulnerabilities

‘SessionShark’ ToolKit Bypasses Microsoft Office 365 MFA

By infosecbulletin / Saturday , April 26 2025

The SessionShark phishing kit bypasses Office 365 MFA by stealing session tokens. Experts warn about real-time attacks using fake login...

Read More

• Alert
• Vulnerabilities

159 CVEs Exploited in Q1 2025 : 28.3% Within 24 Hours of Disclosure

By infosecbulletin / Friday , April 25 2025

In Q1 2025, VulnCheck identified evidence of 159 CVEs publicly disclosed for the first time as exploited in the wild....

Read More

• Alert
• Vulnerabilities

NVIDIA NeMo Framework Vuln Allow Attackers RCE

By infosecbulletin / Friday , April 25 2025

The NVIDIA NeMo Framework has three vulnerabilities that could enable attackers to execute remote code, risking AI system compromise and...

Read More

• Alert
• Vulnerabilities

Cisco Issued Urgent Security Advisories For Multiple Products

By infosecbulletin / Thursday , April 24 2025

Cisco issued a security advisory about a remote code execution (RCE) vulnerability (CVE-2025-32433) affecting multiple products in its portfolio due...

Read More

• Alert
• Vulnerabilities

SonicWall patched SSLVPN Vuln Allowing Firewall Crashing

By infosecbulletin / Thursday , April 24 2025

SonicWall has revealed a vulnerability in its SonicOS SSLVPN Virtual Office interface that could let remote attackers crash firewall appliances....

Read More

• Alert
• Vulnerabilities

GitLab Releases Security Update For Multiple Vulns

By infosecbulletin / Thursday , April 24 2025

GitLab has announced a security advisory urging users to upgrade their self-managed installations right away. Versions 17.11.1, 17.10.5, and 17.9.7...

Read More

• Alert
• Cyber Attack

ISPAB president “whatsapp” got hacked via phishing link

By infosecbulletin / Wednesday , April 23 2025

Imdadul Haque, the president of Internet Service Provider of Bangladesh (ISPAB) said, I automatically got back my WhatsApp account. What...

Read More

• Alert
• Vulnerabilities

Zyxel released patches 2 vulns in its USG FLEX H series firewalls

By infosecbulletin / Wednesday , April 23 2025

Zyxel Networks has issued critical security patches for two high-severity vulnerabilities in its USG FLEX H series firewalls. These flaws...

Read More

CVE-2024-29972

This command injection vulnerability in the CGI program “remote_help-cgi” in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

CVE-2024-29973

This command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted HTTP POST request.

CVE-2024-29974

This remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.

CVE-2024-29975

This improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 and NAS542 devices could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.

CVE-2024-29976

This improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 and NAS542 devices could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.

Outpost24 security researcher Timothy Hjort credited and reported five flaws.