Critical · 9.8 CVE-2023-4473 EUVD-2023-54328GHSA-2h5j-5qmh-v4qh

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21…

Published Nov 30, 2023 · Updated Dec 16, 2025 · Assigned by Zyxel

Vendor: Zyxel Product: NAS326 firmware Product: NAS542 firmware Category: Network devices

Description

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	NAS326 firmware	V5.21(AAZF.14)C0	—
Zyxel	NAS542 firmware	V5.21(ABAG.11)C0	—

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products vendor-advisory
https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/