Command injection

2023-05-3002:15:00

PRIOn knowledge base

www.prio-n.com

zyxel

nas326

firmware

command injection

vulnerability

post-authentication

operating system

administrator privileges

remote execution

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.0%

JSON

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.

CPENameOperatorVersion
nas326_firmwareeq< 5.21aazf.13c0
nas540_firmwareeq< 5.21aatb.10c0
nas542_firmwareeq< 5.21abag.10c0

Name	Operator	Version
nas326_firmware	eq	< 5.21aazf.13c0
nas540_firmware	eq	< 5.21aatb.10c0
nas542_firmware	eq	< 5.21abag.10c0

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products