Zyxel security advisory for post-authentication command injection vulnerability in NAS products
CVE: CVE-2023-5372
Summary
Zyxel has released patches addressing a post-authentication command injection vulnerability in some NAS versions. Users are advised to install them for optimal protection.
What is the vulnerability?
The post-authentication command injection vulnerability in some Zyxel NAS devices could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.
What versions are vulnerable—and what should you do?
After a thorough investigation, we have identified the products affected* at the time of the issue report and provided the firmware patches outlined in the table below.
Affected model | Affected version | Patch availability |
---|---|---|
NAS326 | V5.21(AAZF.15)C0 and earlier | |
NAS542 | V5.21(ABAG.12)C0 and earlier |
*Note that both the vulnerable models reached end-of-vulnerability-support on Dec. 31, 2023.
Got a question?
Please contact your local service rep or visit Zyxel’s community for further information or assistance.
Acknowledgment
Thanks to Gábor Selján from BugProve for reporting the issue to us.
Revision history
2024-1-30: Initial release.
Categories
- All Categories
- 397 Beta Program
- 2.1K Nebula
- 117 Nebula Ideas
- 81 Nebula Status and Incidents
- 5.1K Security
- 91 USG FLEX H Series
- 247 Security Ideas
- 1.3K Switch
- 69 Switch Ideas
- 920 WirelessLAN
- 35 WLAN Ideas
- 5.9K Consumer Product
- 210 Service & License
- 337 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2K FAQ
- 931 Nebula FAQ
- 423 Security FAQ
- 238 Switch FAQ
- 210 WirelessLAN FAQ
- 47 Consumer Product FAQ
- 139 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 72 About Community
- 62 Security Highlight