CVE-2023-4473criticalobserved exploitationCWE-78

CVE-2023-4473: critical vulnerability in Zyxel NAS326 firmware

Published · Updated

Follow this CVE+ Monitor NAS326+ Monitor NAS542

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

62Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 9.8epss 41%
from disclosure to weapon
Published on NVDNov 30
VulnCheck+150d
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · NAS326 firmwareZyxel · NAS542 firmware
Related CVEs — Zyxel NAS326 firmware

In the same product, most dangerous first.

CVE-2023-27992CRITICALCVE-2023-27992EPSS 82.3%KEVCVE-2024-29972CRITICALCVE-2024-29972EPSS 90.3%CVE-2024-29973CRITICALCVE-2024-29973EPSS 86.2%CVE-2023-37928HIGHCVE-2023-37928EPSS 60.2%CVE-2023-35138CRITICALCVE-2023-35138EPSS 40.0%CVE-2023-4474CRITICALCVE-2023-4474EPSS 29.7%