High · 7.2 CVE-2023-27988 EUVD-2023-31713GHSA-wc8j-6g5m-3r95

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an auth…

Published May 30, 2023 · Updated Jan 14, 2025 · Assigned by Zyxel

Vendor: Zyxel Product: NAS326 firmware Category: Network devices

Description

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	NAS326 firmware	< V5.21(AAZF.13)C0	—

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products