High · 8.8 CVE-2023-33013 EUVD-2023-37202GHSA-xw24-fjv7-8w94

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an a…

Published Aug 14, 2023 · Updated Oct 9, 2024 · Assigned by Zyxel

Vendor: Zyxel Product: NBG6604 firmware Category: Network devices

Description

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	NBG6604 firmware	V1.01(ABIR.1)C0	—

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-in-ntp-feature-of-nbg6604-home-router vendor-advisory