The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.
References
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
21 Nov 2024, 07:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products - Patch, Vendor Advisory |
02 Jun 2023, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 | |
| First Time |
Zyxel nas326
Zyxel nas542 Firmware Zyxel nas540 Zyxel nas542 Zyxel nas540 Firmware Zyxel nas326 Firmware Zyxel |
|
| CPE | cpe:2.3:o:zyxel:nas540_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:* cpe:2.3:h:zyxel:nas540:-:*:*:*:*:*:*:* cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:* |
|
| References | (CONFIRM) https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products - Patch, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
30 May 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-30 02:15
Updated : 2024-11-21 07:53
NVD link : CVE-2023-27988
Mitre link : CVE-2023-27988
CVE.ORG link : CVE-2023-27988
JSON object : View
Products Affected
zyxel
- nas540_firmware
- nas540
- nas542_firmware
- nas542
- nas326_firmware
- nas326
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')