High · 8.8 CVE-2023-37927 EUVD-2023-41780GHSA-rxh8-p4v2-m8hf

The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmwar…

Published Nov 30, 2023 · Updated Feb 13, 2025 · Assigned by Zyxel

Vendor: Zyxel Product: NAS326 firmware Product: NAS542 firmware Category: Network devices

Description

The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	NAS326 firmware	V5.21(AAZF.14)C0	—
Zyxel	NAS542 firmware	V5.21(ABAG.11)C0	—

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products vendor-advisory
https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/