PT-2023-3171 · Zyxel · Zyxel Nas540+2

Andrej Zaujec + 1 · Published 2023-06-19 · Updated 2023-09-29 · CVE-2023-27992

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 versions prior to V5.21(AAZF.14)C0 Zyxel NAS540 versions prior to V5.21(AATB.11)C0 Zyxel NAS542 versions prior to V5.21(ABAG.11)C0

Description The pre-authentication command injection issue in Zyxel NAS devices could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request. This could enable an attacker to run arbitrary commands on affected systems.

Recommendations For Zyxel NAS326 versions prior to V5.21(AAZF.14)C0, update to version V5.21(AAZF.14)C0 or later. For Zyxel NAS540 versions prior to V5.21(AATB.11)C0, update to version V5.21(AATB.11)C0 or later. For Zyxel NAS542 versions prior to V5.21(ABAG.11)C0, update to version V5.21(ABAG.11)C0 or later. As a temporary workaround, consider restricting access to the affected devices until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-03280

CVE-2023-27992

Affected Products

Zyxel Nas326

Zyxel Nas540

Zyxel Nas542

References · 10

• https://osv.dev/vulnerability/CVE-2023-27992 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03280 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27992 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products · Vendor Advisory, Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27992 · Note
• https://t.me/pentestingnews/36995 · Telegram Post
• https://t.me/thehackernews/3503 · Telegram Post
• https://twitter.com/clovernetics/status/1707727686070600089 · Twitter Post
• https://t.me/pentestingnews/37041 · Telegram Post
• https://t.me/cvenotify/53128 · Telegram Post