iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Zyxel NAS vulnerability linked to a botnet is CVE-2024-29973, an unauthenticated command-injection flaw affecting the NAS326 and NAS542 on specified older firmware. Zyxel’s listed fixes are available to customers with extended support, but both models reached end of vulnerability support on December 31, 2023. Owners should check their model and firmware, ask Zyxel or their support representative about patch access, and reduce exposure while deciding whether to replace an unsupported device.
What the botnet advisory says about Zyxel NAS devices
A joint advisory published September 18, 2024, by the FBI, Cyber National Mission Force, NSA, and allied partners identifies CVE-2024-29973 among vulnerabilities Integrity Technology Group (Integrity Tech) used to acquire devices for its botnet. The advisory describes Integrity Tech as a PRC-based company that controlled and managed a botnet active since mid-2021. Read the joint advisory.
The advisory describes a customized Mirai-based system that exploited known vulnerabilities in internet-connected devices, ran malware, and connected infected devices to command-and-control infrastructure. It warns that the botnet could provide cover for malicious activity, including distributed denial-of-service attacks and intrusions into targeted networks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The advisory does not say how many Zyxel NAS326 or NAS542 devices were compromised. Its size figures describe the botnet overall, not Zyxel NAS units: it estimated more than 260,000 compromised devices as of June 2024. A separate June 2024 snapshot of the botnet management database contained more than 1.2 million records, including more than 385,000 unique U.S. victim devices; records included devices previously and actively exploited. These dated figures are not current 2026 counts and cannot be used to infer the number of affected Zyxel NAS devices.
#1 Best Overall
- Automatically upload files to Flickr, YouTube, or file hosting websites
- Works as iTunes & Squeezebox server to share streaming music
- zPilot organizes files with simple drag-and-drop.
- Built-in hard drive bay turns your spare hard drive into a full-featured media server
- DLNA 1.5 certification ensures compatibility with a wide range of media devices
Which Zyxel NAS models and firmware are affected?
Zyxel’s June 4, 2024 security advisory says a crafted HTTP POST request involving the setCookie parameter could let an unauthenticated attacker execute some operating-system commands. The advisory lists these affected firmware versions and fixes:
| Model | Affected firmware listed by Zyxel | Listed patch | Support status |
|---|---|---|---|
| NAS326 | V5.21(AAZF.16)C0 and earlier | V5.21(AAZF.17)C0 | End of vulnerability support: December 31, 2023 |
| NAS542 | V5.21(ABAG.13)C0 and earlier | V5.21(ABAG.14)C0 | End of vulnerability support: December 31, 2023 |
Zyxel’s advisory for multiple NAS vulnerabilities says the patches were made available to customers with extended support. Because the models are beyond end of vulnerability support, do not assume that every owner can download the fixes; confirm access with Zyxel or the relevant support representative.
Rank #2
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
The same Zyxel advisory covers CVE-2024-29972 and CVE-2024-29974 through CVE-2024-29976 in these NAS models. Those are separate flaws. The joint botnet advisory specifically lists CVE-2024-29973 among the observed vulnerabilities used in device acquisition.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
Rank #4
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
Rank #3
- Personal & Home Private Storage: Yxk Zero1 2-Bay NAS is your gateway to stress-free private storage. Built for beginners who crave simplicity, it brings your scattered photos, videos, and files together into one secure home hub — no tech skills needed. Say goodbye to the chaos of multiple drives and cloud subscriptions, and hello to effortless access wherever you are. This entry-level 2-bay NAS is perfect for personal entertainment, photo backup, and worry-free data protection — now with Docker support for those ready to explore more.
- One-Time Investment, Lifelong Storage Freedom: Unlike Cloud storage with its recurring subscription fees and ever-shrinking free tiers, Yxk Zero1 NAS is a one-time purchase that puts you in complete control of your data. **The Hard Drive Must Be Purchased Separately — add or replace drives as your collection grows, no monthly bills, no storage limits imposed by others, and no risk of sudden price hikes. Your NAS, your rules, forever.
- Remote Access From Any Device: Once your NAS is set up, that's all you need to remember. Browse, upload, and share files from your phone app, desktop client, or any web browser — Windows, macOS, iOS, or Android. One central hub, everywhere you go.
- Blazing 2.5GbE Speed: With 2.5GbE connectivity — 2.5x faster than standard 1GbE — your files transfer in a flash and 4K streams without buffering. Flexible RAID modes, automated backups, and snapshot recovery work quietly in the background, so your data stays safe from drive failures or accidental loss. Speed without compromise, protection without complexity.
- Your Private Cloud Shared Your Way: You own your data — all of it, 100%. Advanced encryption and granular permission controls keep your files protected whether they're stored locally or shared with family and friends. Set up dedicated spaces for each user, so everyone gets seamless access across devices while keeping personal files truly personal. Privacy isn't a feature; it's the foundation.
What NAS326 and NAS542 owners should do
- Identify the device and firmware. Check the NAS label or administration interface for the exact model and installed firmware version. Compare it with Zyxel’s affected-version list above.
- Ask about the patch. If the NAS is on an affected version, contact Zyxel or your support representative about eligibility for the model-specific patch. Zyxel says the listed fixes were offered to customers with extended support.
- Reduce internet exposure. Disable remote access, file-sharing features, and other exposed services or ports that you do not need. The FBI’s recommended mitigations include disabling unused services and ports, including remote access and file-sharing features. The joint advisory’s mitigation guidance also recommends applying software and firmware updates.
- Strengthen network controls. Replace default credentials with strong passwords, restrict access with network segmentation and least-privilege permissions, and keep firmware and software updated.
- Plan for replacement if support is unavailable. The FBI-recommended guidance says to replace end-of-life equipment with devices that remain within their vendors’ support plans. For a replacement NAS, confirm the manufacturer’s security-support coverage; the advisory does not compare specific models, prices, storage capacities, or performance.
- Watch for unusual activity. Monitor network traffic and plan a reboot as one possible response step. A reboot may terminate some memory-resident malware, but it does not prove the NAS is clean or repair an unpatched vulnerability.
What the available evidence does—and does not—establish
- Established: The joint advisory lists CVE-2024-29973 as an observed vulnerability used to acquire devices for the botnet, and Zyxel identifies the NAS326 and NAS542 firmware ranges affected by that flaw.
- Not established: The number of Zyxel NAS devices compromised, whether a particular NAS was attacked, whether a patched NAS is malware-free, or whether extended-support patches are currently available to a particular owner.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
