CVE-2019-10631

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.
References
Link Resource
http://maxwelldulin.com/BlogPost?post=3236967424 Exploit Third Party Advisory
http://maxwelldulin.com/BlogPost?post=3236967424 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:19

Type Values Removed Values Added
References () http://maxwelldulin.com/BlogPost?post=3236967424 - Exploit, Third Party Advisory () http://maxwelldulin.com/BlogPost?post=3236967424 - Exploit, Third Party Advisory

Information

Published : 2019-04-09 05:29

Updated : 2024-11-21 04:19


NVD link : CVE-2019-10631

Mitre link : CVE-2019-10631

CVE.ORG link : CVE-2019-10631


JSON object : View

Products Affected

zyxel

  • nas326
  • nas326_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')