PT-2023-7313 · Zyxel · Zyxel Nas542+1

Maxim Suslov · Publicado 2023-11-30 · Atualizado 2025-07-28 · CVE-2023-35138

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 version V5.21(AAZF.14)C0 Zyxel NAS542 version V5.21(ABAG.11)C0

Description A command injection issue exists in the show zysync server contents function, allowing an unauthenticated attacker to execute some operating system commands by sending a crafted HTTP POST request. This is due to the lack of neutralization of special elements used in the operating system command. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For Zyxel NAS326 version V5.21(AAZF.14)C0, consider disabling the show zysync server contents function until a patch is available. For Zyxel NAS542 version V5.21(ABAG.11)C0, consider disabling the show zysync server contents function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-08342

CVE-2023-35138

Produtos afetados

Zyxel Nas326

Zyxel Nas542

Referências · 9

• https://t.me/true_secator/5152 · Publicação no Telegram
• https://twitter.com/GuidedHacking/status/1949912696230744160 · Publicação no Twitter
• https://twitter.com/snowcra5h/status/1739193087153541366 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-08342 · Nota de Segurança
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products · Aviso do Fabricante
• https://t.me/cvenotify/62372 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-35138 · Aviso do Fabricante
• https://t.me/cvenotify/61653 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-35138 · Nota de Segurança