CVE-2023-37928

🗓️ 30 Nov 2023 01:37:27Reported by ZyxelType

A post-authentication command injection vulnerability in Zyxel NAS326 and NAS542 firmware

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2023-37928	1 Dec 202313:01	–	circl
CNNVD	Zyxel NAS326 Operating System Command Injection Vulnerability	30 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-37928	30 Nov 202301:37	–	cvelist
EUVD	EUVD-2023-41780	3 Oct 202520:07	–	euvd
EUVD	EUVD-2023-41781	3 Oct 202520:07	–	euvd
NVD	CVE-2023-37928	30 Nov 202302:15	–	nvd
OpenVAS	Zyxel NAS Multiple Vulnerabilities (Jun/Nov 2023) - Active Check	7 Aug 202500:00	–	openvas
OSV	CVE-2023-37927	30 Nov 202302:15	–	osv
OSV	CVE-2023-37928	30 Nov 202302:15	–	osv
Prion	Input validation	30 Nov 202302:15	–	prion

NVD

Node

zyxel nas326_firmwareRange≤5.21(aazf.14)c0

AND

zyxel nas326Match-

Node

zyxel nas542_firmwareRange≤5.21(abag.11)c0

AND

zyxel nas542Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "NAS326 firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "V5.21(AAZF.14)C0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NAS542 firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "V5.21(ABAG.11)C0"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
bugprove	www.bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/

21 Nov 2024 08:12Current

9.1High risk

Vulners AI Score9.1

CVSS 3.18.8

EPSS0.02145

CWE-78