Critical · 9.8 CVE-2023-4474 EUVD-2023-54329GHSA-h9w9-8x3q-c9vg

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmwar…

Published Nov 30, 2023 · Updated Dec 16, 2025 · Assigned by Zyxel

Vendor: Zyxel Product: NAS326 firmware Product: NAS542 firmware Category: Network devices

Description

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	NAS326 firmware	V5.21(AAZF.14)C0	—
Zyxel	NAS542 firmware	V5.21(ABAG.11)C0	—

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products vendor-advisory
https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/