Lucene search
PRIOn knowledge basePRION:CVE-2023-37928HistoryNov 30, 2023 - 2:15 a.m.
Command injection
2023-11-3002:15:00
PRIOn knowledge base
www.prio-n.com
2
command injection
wsgi server
zyxel nas326
zyxel nas542
firmware vulnerability
authenticated attacker
crafted url
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nas326_firmware | eq | <= 5.21aazf.14c0 | |
| nas542_firmware | eq | <= 5.21abag.11c0 |
References
bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
Related
nvd
nvd
CVE-2023-37928
2023-11-30 02:15:43
cve
cve
CVE-2023-37928
2023-11-30 02:15:43
cvelist
cvelist
CVE-2023-37928
2023-11-30 01:37:27
thn
thn
Zyxel Releases Patches to Fix 15 Flaws in NAS, Firewall, and AP Devices
2023-12-01 06:22:00