CVE-2023-27992criticalunder attackCWE-78

CVE-2023-27992: critical vulnerability in Zyxel NAS326 firmware

Published · Updated

Follow this CVE+ Monitor NAS326+ Monitor NAS542

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 82%
from disclosure to weapon
Published on NVDJun 19
CISA KEV+4d
Action required by CISAfederal deadline: 2023-07-14

Apply updates per vendor instructions.

In short

A flaw in Zyxel NAS devices allows anyone on the network to run harmful commands on the device without needing a password, by sending a specially crafted web request. This can lead to complete device compromise and data theft.

Technical detail

Pre-authentication command injection in Zyxel NAS326, NAS540, and NAS542 devices allows unauthenticated attackers to execute arbitrary OS commands via crafted HTTP requests. The vulnerability affects firmware versions prior to specific patches (V5.21(AAZF.14)C0, V5.21(AATB.11)C0, and V5.21(ABAG.11)C0 respectively) and requires no prior authentication, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · NAS326 firmwareZyxel · NAS540 firmwareZyxel · NAS542 firmware
Related CVEs — Zyxel NAS326 firmware

In the same product, most dangerous first.

CVE-2024-29972CRITICALCVE-2024-29972EPSS 90.3%CVE-2024-29973CRITICALCVE-2024-29973EPSS 86.2%CVE-2023-37928HIGHCVE-2023-37928EPSS 60.2%CVE-2023-4473CRITICALCVE-2023-4473EPSS 41.3%CVE-2023-35138CRITICALCVE-2023-35138EPSS 40.0%CVE-2023-4474CRITICALCVE-2023-4474EPSS 29.7%