Attackers exploit a vulnerability in old Zyxel NAS devices to integrate them into a botnet.

Old Zyxel NAS devices are being targeted by criminals who are using previously disclosed vulnerabilities to penetrate Zyxel’s storage servers and then integrate them into a botnet that has similarities to Mirai, according to the Shadowserver Foundation.

The basis is the vulnerability CVE-2024-29973. This allows hackers to exploit the NAS devices via an HTTP POST request. The vulnerability was rated with a value of 9.8 and is therefore critical.

It affects firmware V5.21 and older on Zyxel NAS326 and NAS342 devices. Anyone with an affected device can install the V5.21(AAZF.17)C0 patch. Zyxel deserves a lot of credit for these patches, as both NAS devices are no longer supported. It expired on December 31st last year. Given the severity of the bug, the manufacturer has now provided a patch. The update can be found here.

Popular destination

NAS devices are popular targets for attackers because they often contain a lot of important data. This makes them interesting for ransomware. In addition, things are permanently online but do not always enjoy the same level of security as a professional server. This makes a NAS a welcome addition to a botnet.

From an attacker’s perspective, a NAS has a lot to offer, which is why we regularly see campaigns targeting devices from popular manufacturers like Qnap. It is now more important than ever for NAS owners to implement the latest security updates in a timely manner.