The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
References
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
21 Nov 2024, 07:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products - Patch, Vendor Advisory |
27 Jun 2023, 12:49
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 | |
| First Time |
Zyxel nas326
Zyxel nas542 Firmware Zyxel nas326 Firmware Zyxel nas542 Zyxel nas540 Firmware Zyxel nas540 Zyxel |
|
| CPE | cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:* cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:* cpe:2.3:h:zyxel:nas540:-:*:*:*:*:*:*:* cpe:2.3:o:zyxel:nas540_firmware:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products - Patch, Vendor Advisory |
19 Jun 2023, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-19 12:15
Updated : 2024-11-21 07:53
NVD link : CVE-2023-27992
Mitre link : CVE-2023-27992
CVE.ORG link : CVE-2023-27992
JSON object : View
Products Affected
zyxel
- nas540_firmware
- nas326_firmware
- nas326
- nas542_firmware
- nas542
- nas540
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')