CVE-2023-37928highCWE-78

CVE-2023-37928: high-severity vulnerability in Zyxel NAS326 firmware

Published · Updated

Follow this CVE+ Monitor NAS326+ Monitor NAS542

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 60%
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · NAS326 firmwareZyxel · NAS542 firmware
Related CVEs — Zyxel NAS326 firmware

In the same product, most dangerous first.

CVE-2023-27992CRITICALCVE-2023-27992EPSS 82.3%KEVCVE-2024-29972CRITICALCVE-2024-29972EPSS 90.3%CVE-2024-29973CRITICALCVE-2024-29973EPSS 86.2%CVE-2023-4473CRITICALCVE-2023-4473EPSS 41.3%CVE-2023-35138CRITICALCVE-2023-35138EPSS 40.0%CVE-2023-4474CRITICALCVE-2023-4474EPSS 29.7%