PT-2019-11950 · Zyxel · Zyxel Nas326

Maxwell Dulin · Publicado 2019-04-09 · Atualizado 2020-08-24 · CVE-2019-10631

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel NAS 326 versions 5.21 and below

Description The issue allows an authenticated attacker to execute arbitrary code via multiple different requests due to Shell Metacharacter Injection in the package installer.

Recommendations For Zyxel NAS 326 versions 5.21 and below, update to a version above 5.21 to resolve the issue.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-10631

Produtos afetados

Zyxel Nas326

Referências · 3

• 🔥 http://maxwelldulin.com/BlogPost?post=3236967424 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10631 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10631 · Nota de Segurança