Lucene search
PRIOn knowledge basePRION:CVE-2023-4474HistoryNov 30, 2023 - 2:15 a.m.
Input validation
2023-11-3002:15:00
PRIOn knowledge base
www.prio-n.com
3
input validation
wsgi server
zyxel nas326
nas542
firmware
os command execution
crafted urls
unauthenticated attacker
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nas326_firmware | eq | <= 5.21aazf.14c0 | |
| nas542_firmware | eq | <= 5.21abag.11c0 |
References
bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
Related
cve
cve
CVE-2023-4474
2023-11-30 02:15:43
nvd
nvd
CVE-2023-4474
2023-11-30 02:15:43
cvelist
cvelist
CVE-2023-4474
2023-11-30 01:45:29
thn
thn
Zyxel Releases Patches to Fix 15 Flaws in NAS, Firewall, and AP Devices
2023-12-01 06:22:00