CVE-2023-5372 - The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface

Back Back to CVE browser

HIGH

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface

Published Jan 30, 2024

7.2

HIGH

CVSS 3.1

EPSS 28.47%

Description

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.

Affected products

Vendor Zyxel Product NAS326 firmware Default
unaffected
- Version
  <= V5.21(AAZF.15)C0
  Status
  affected
  Constraints
  -
Vendor Zyxel Product NAS542 firmware Default
unaffected
- Version
  <= V5.21(ABAG.12)C0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zyxel

NAS326 firmware

unaffected

Version	Status	Constraints
<= V5.21(AAZF.15)C0	affected	-

Zyxel

NAS542 firmware

unaffected

Version	Status	Constraints
<= V5.21(ABAG.12)C0	affected	-

Vendor Zyxel Product Nas326 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=5.21(AAZF.15)C0
Vendor Zyxel Product Nas542 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=5.21(ABAG.12)C0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zyxel

Nas326 Firmware

n/a

Version	Status	Constraints
0	affected	<=5.21(AAZF.15)C0

Zyxel

Nas542 Firmware

n/a

Version	Status	Constraints
0	affected	<=5.21(ABAG.12)C0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57688
Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57688		Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024		vendor-advisoryVendor Advisory