Zyxel Releases Patches for Firmware Vulnerabilities

Zyxel has released patches addressing command injection and remote code execution vulnerabilities in two NAS products that have reached end-of-vulnerability-support. Users are advised to install them for optimal protection.

Three out of five vulnerabilities could allow an unauthorized attacker to run operating system commands and arbitrary code on affected installations.

• Daily Security Update
• Data Breach

Daily Cyber security update for 24. 10. 2026

By infosecbulletin / Saturday , October 24 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Alert

PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation

By infosecbulletin / Friday , October 23 2026

The PHP security team shared ways to protect against a new flaw that lets someone run unwanted code on certain...

Read More

• Hot Topic

US banks faced unauthorized access by AI agents in customer accounts: Axios reports

By infosecbulletin / Friday , October 23 2026

Major US banks have detected unauthorized access to customer accounts by third-party AI agents, with some systems taking actions beyond...

Read More

• Alert

Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager

By infosecbulletin / Thursday , October 22 2026

Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated...

Read More

• Cyber Attack
• Data Breach

Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed

By infosecbulletin / Wednesday , October 21 2026

Hacker offers to sell Rajasthan Government’s Department of Information Technology & Communication (DoIT&C) data in a underground forum. The threat...

Read More

• Alert

Update now! PHP2Shell: Critical PHP vulnerabilities patched

By infosecbulletin / Wednesday , October 21 2026

The PHP team released urgent security updates to fix PHP2Shell, two serious flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run...

Read More

• Hot Topic

Trump says data centres should pay dividends to local community

By infosecbulletin / Wednesday , October 21 2026

US President Donald Trump said on Wednesday that companies ​building data centers should pay a "dividend" to the communities ‌where...

Read More

• Alert
• Cyber Attack

Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257

By infosecbulletin / Tuesday , October 20 2026

Ransomware groups are using a flaw in Palo Alto Networks GlobalProtect VPN to get around multi-factor authentication and access corporate...

Read More

• Hot Topic

DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools

By infosecbulletin / Tuesday , October 20 2026

The U.S. Department of Homeland Security (DHS) ordered federal agencies to stop using DeepSeek products and remove it from all...

Read More

• Hot Topic

CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines

By infosecbulletin / Monday , October 19 2026

NSA, CISA, and NIST have released security guidelines to find, control, and stop AI agents that go beyond their allowed...

Read More

CVE-2024-29972

This command injection vulnerability in the CGI program “remote_help-cgi” in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

CVE-2024-29973

This command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted HTTP POST request.

CVE-2024-29974

This remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.

CVE-2024-29975

This improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 and NAS542 devices could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.

CVE-2024-29976

This improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 and NAS542 devices could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.

Outpost24 security researcher Timothy Hjort credited and reported five flaws.