Lucene search
PRIOn knowledge basePRION:CVE-2023-37927HistoryNov 30, 2023 - 2:15 a.m.
Input validation
2023-11-3002:15:00
PRIOn knowledge base
www.prio-n.com
4
zyxel
nas326
nas542
firmware
cgi program
operating system command
execution
authenticated attacker
url
vulnerability
The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nas326_firmware | eq | <= 5.21aazf.14c0 | |
| nas542_firmware | eq | <= 5.21abag.11c0 |
References
bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
Related
nvd
nvd
CVE-2023-37927
2023-11-30 02:15:42
cve
cve
CVE-2023-37927
2023-11-30 02:15:42
cvelist
cvelist
CVE-2023-37927
2023-11-30 01:34:28
thn
thn
Zyxel Releases Patches to Fix 15 Flaws in NAS, Firewall, and AP Devices
2023-12-01 06:22:00