Zyxel security advisory for authentication bypass and command injection vulnerabilities in NAS ...

Zyxel_May

Zyxel security advisory for authentication bypass and command injection vulnerabilities in NAS products

CVEs: CVE-2023-35137, CVE-2023-35138, CVE-2023-37927, CVE-2023-37928, CVE-2023-4473, CVE-2023-4474

Summary

Zyxel has released patches addressing an authentication bypass vulnerability and command injection vulnerabilities in NAS products. Users are advised to install them for optimal protection.

What are the vulnerabilities?

CVE-2023-35137

An improper authentication vulnerability in the authentication module in Zyxel NAS devices could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.

CVE-2023-35138

A command injection vulnerability in the “show_zysync_server_contents” function in Zyxel NAS devices could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

CVE-2023-37927

The improper neutralization of special elements in the CGI program in Zyxel NAS devices could allow an authenticated attacker to execute some OS commands by sending a crafted URL to a vulnerable device.

CVE-2023-37928

A post-authentication command injection vulnerability in the WSGI server in Zyxel NAS devices could allow an authenticated attacker to execute some OS commands by sending a crafted URL to a vulnerable device.

CVE-2023-4473

A command injection vulnerability in the web server in Zyxel NAS devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted URL to a vulnerable device.

CVE-2023-4474

The improper neutralization of special elements in the WSGI server in Zyxel NAS devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted URL to a vulnerable device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period, with their firmware patches shown in the table below.

Affected model	Affected version	Patch availability
NAS326	V5.21(AAZF.14)C0 and earlier	V5.21(AAZF.15)C0
NAS542	V5.21(ABAG.11)C0 and earlier	V5.21(ABAG.12)C0

Got a question?

Please contact your local service rep or visit Zyxel’s community for further information or assistance.

Acknowledgment

Thanks to the following security researchers and consultancies:

• Maxim Suslov for CVE-2023-35137 and CVE-2023-35138
• Gábor Selján from BugProve for CVE-2023-37927, CVE-2023-37928, CVE-2023-4473, and CVE-2023-4474
• Drew Balfour from IBM X-Force for CVE-2023-4473

Revision history

2023-11-30: Initial release.