PT-2023-8182 · Zyxel · Zyxel Nas542+1

Gábor Selján · Publicado 2023-07-01 · Atualizado 2023-12-06 · CVE-2023-37928

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 version V5.21(AAZF.14)C0 Zyxel NAS542 version V5.21(ABAG.11)C0

Description A post-authentication command injection issue in the WSGI server of the Zyxel NAS326 and NAS542 firmware could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device. The vulnerability is related to the failure to neutralize special elements used in OS commands, which can be exploited by sending a specially crafted URL to the device.

Recommendations For Zyxel NAS326 version V5.21(AAZF.14)C0, consider disabling the WSGI server until a patch is available. For Zyxel NAS542 version V5.21(ABAG.11)C0, consider disabling the WSGI server until a patch is available. As a temporary workaround, avoid using the vulnerable WSGI server functionality until the issue is resolved.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2024-00170

CVE-2023-37928

Produtos afetados

Zyxel Nas326

Zyxel Nas542

Referências · 10

• https://t.me/cvenotify/61655 · Publicação no Telegram
• https://t.me/true_secator/5152 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37928 · Aviso do Fabricante
• https://t.me/cvenotify/62428 · Publicação no Telegram
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-00170 · Nota de Segurança
• https://t.me/cvenotify/62427 · Publicação no Telegram
• https://t.me/cvenotify/62348 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37928 · Nota de Segurança
• https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices · Nota