PT-2023-7333 · Zyxel · Zyxel Nas542+1

Gábor Selján · Published 2023-11-30 · Updated 2024-04-30 · CVE-2023-4474

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 version V5.21(AAZF.14)C0 Zyxel NAS542 version V5.21(ABAG.11)C0

Description The issue arises from the improper neutralization of special elements in the WSGI server, allowing an unauthenticated attacker to execute some operating system commands by sending a crafted URL to a vulnerable device. This could enable a remote attacker to execute arbitrary OS commands.

Recommendations For Zyxel NAS326 version V5.21(AAZF.14)C0, consider disabling the WSGI server until a patch is available. For Zyxel NAS542 version V5.21(ABAG.11)C0, consider disabling the WSGI server until a patch is available. As a temporary workaround, avoid using the vulnerable WSGI server functionality until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-08363

CVE-2023-4474

Affected Products

Zyxel Nas326

Zyxel Nas542

References · 15

• https://bdu.fstec.ru/vul/2023-08363 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4474 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4474 · Vendor Advisory
• https://t.me/cvenotify/61657 · Telegram Post
• https://t.me/cvenotify/62350 · Telegram Post
• https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices · Note
• https://t.me/cvenotify/62439 · Telegram Post
• https://t.me/cvenotify/62438 · Telegram Post
• https://t.me/true_secator/5152 · Telegram Post
• https://twitter.com/sans_isc/status/1785328552990138803 · Twitter Post
• https://twitter.com/reverseame/status/1760929995864605116 · Twitter Post
• https://t.me/secharvester/14838 · Telegram Post
• https://t.me/thebugbountyhunter/8091 · Telegram Post
• https://twitter.com/IT_securitynews/status/1785331590475685916 · Twitter Post