If your business still runs a Zyxel NAS326 or NAS542, you need to read this. The networking vendor has released hotfixes for a critical command injection vulnerability—CVE-2024-6342—that could let unauthenticated attackers run operating system commands on your storage hardware. The affected devices have already reached their end-of-vulnerability-support date, which makes this release notable. Here's what it means for your team.
Quick take
- CVE-2024-6342 affects Zyxel NAS326 and NAS542 devices
- Unauthenticated attackers can trigger it via specially crafted HTTP POST requests
- Hotfixes are available for customers with extended support contracts
- Zyxel hasn't confirmed active exploitation but urges immediate patching
- Earlier this year, Mirai-like botnets targeted similar flaws in these same devices
What the vulnerability does
The flaw lives in the export-cgi program on these NAS devices. An attacker doesn't need any login credentials—just a specially crafted HTTP POST request sent to the device. If successful, they can execute operating system commands. That puts your stored data, backups, and network access at direct risk.
Network-attached storage devices are particularly attractive to cybercriminals precisely because they sit at the intersection of valuable data and often-limited security attention. A compromised NAS can become a staging point for deeper network intrusion or get recruited into a botnet.
Why Zyxel released patches for end-of-life hardware
Both the NAS326 and NAS542 have passed their end-of-vulnerability-support dates. Generally, that means no more official patches. Zyxel made an exception here because of the critical severity rating. The company stated it released the hotfixes "despite the products already having reached end-of-vulnerability-support" specifically for customers who purchased extended support.
If you're running either model and don't have extended support, you're in a different situation—one we'll get to shortly.
What this means for you
The practical question is simple: do you have extended support? If you manage IT infrastructure for an SMB, check your contracts and device firmware dates. For devices under extended support, apply the hotfixes immediately. Zyxel has provided them for exactly this scenario.
If your devices are past support, you face a harder choice. You could replace the hardware, which costs money but removes the risk. You could implement network controls—like restricting access to the affected CGI endpoints through your firewall—but that mitigates rather than eliminates the threat. You could also isolate these devices from sensitive network segments.
Say you are running a NAS542 as your team's shared backup drive for sprint documentation and design assets. You discover it falls outside extended support. The most immediate step is to verify whether its web interface is accessible from the internet. If it is, block that access at the firewall level now—then schedule a hardware review for the next quarter.
Why this keeps happening with NAS devices
Earlier this year, researchers spotted a Mirai-like botnet attempting to exploit another command injection vulnerability in these same Zyxel models. The pattern is familiar: end-of-life NAS hardware remains deployed for years, often without补丁 or monitoring, making it a reliable target for automated attacks.
Key takeaways
- If you have extended support for NAS326 or NAS542, apply Zyxel's hotfixes without delay
- If your devices are past support, consider replacement or strict network isolation as long-term solutions
- Regularly audit whether any network-attached storage is directly internet-accessible—close that vector if found
Frequently asked questions
Which Zyxel devices are affected by CVE-2024-6342?
The NAS326 and NAS542 models are vulnerable. Both have reached end-of-vulnerability-support, but Zyxel released hotfixes for customers with extended support contracts.
Do we know if attackers are actively exploiting this vulnerability?
Zyxel has not confirmed active exploitation. However, similar command injection flaws in these devices were recently targeted by Mirai-like botnets, so the risk is real.
What should we do if our device is past its support date?
You have three main options: replace the hardware, isolate it from internet-accessible networks and sensitive segments, or contact Zyxel about extended support. Continuing to run it unchanged is the riskiest path.
Who reported this vulnerability?
Nanyu Zhong and Jinwei Dong from VARAS@IIE identified and reported CVE-2024-6342.
Is there a simple way to check if our NAS is accessible from the internet?
Yes—run a scan from an external IP lookup tool against your public IP, or check your router's port forwarding rules for anything pointing to the NAS device's internal IP. Direct web interface exposure is the most dangerous configuration.