PT-2024-1409 · Zyxel · Zyxel Nas542+1

Gábor Selján · Published 2024-01-29 · Updated 2024-02-05 · CVE-2023-5372

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 versions through V5.21(AAZF.15)C0 Zyxel NAS542 versions through V5.21(ABAG.12)C0

Description The issue is related to a post-authentication command injection vulnerability. It could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface. This is due to the lack of measures to neutralize special elements used in the operating system command.

Recommendations For Zyxel NAS326 versions through V5.21(AAZF.15)C0, consider disabling access to the web management interface until a patch is available. For Zyxel NAS542 versions through V5.21(ABAG.12)C0, restrict access to the web management interface to minimize the risk of exploitation. As a temporary workaround, avoid using the vulnerable query parameter in the affected URL until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-00880

CVE-2023-5372

Affected Products

Zyxel Nas326

Zyxel Nas542

References · 7

• https://bdu.fstec.ru/vul/2024-00880 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5372 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5372 · Vendor Advisory
• https://twitter.com/RedPacketSec/status/1753359039906361694 · Twitter Post
• https://t.me/cvenotify/70123 · Telegram Post
• https://t.me/cvenotify/69174 · Telegram Post