CVE-2023-4474

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-4474

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-4474

CVE-2023-4474 affects Zyxel NAS326 and NAS542 devices. The root cause is improper neutralization of special elements in the WSGI server, allowing an unauthenticated attacker to execute OS commands by sending a crafted URL. Affected firmwares: NAS326 up to V5.21(AAZF.14)C0 and NAS542 up to V5.21(A...

CVE-2023-4473

CVE-2023-4473 and CVE-2023-4474 affect Zyxel NAS326 (firmware V5.21(AAZF.14)C0) and NAS542 (V5.21(ABAG.11)C0). The web server vulnerabilities allow an unauthenticated attacker to execute OS commands via crafted URLs; CVE-2023-4473 is a command injection and CVE-2023-4474 a faulty neutralization i...

CVE-2023-4473

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-4473

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2023-37928

CVE-2023-37928 affects Zyxel NAS326 and NAS542: a post-authentication command-injection in the WSGI server could allow an authenticated attacker to execute OS commands via a crafted URL. The 3.1.9 CVE entry notes a high-severity impact (CVSS 8.8; network attack vector, require LOW privileges, no ...

CVE-2023-37928

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable devic...

CVE-2023-37927

CVE-2023-37927 and CVE-2023-37928 affect Zyxel NAS326 (firmware V5.21(AAZF.14)C0) and NAS542 (V5.21(ABAG.11)C0). The flaws stem from improper neutralization in the CGI/WSGI handling, enabling an authenticated attacker to execute OS commands via crafted URLs. CVE-2023-37927 is described as imprope...

CVE-2023-35138

CVE-2023-35138 describes a command-injection vulnerability in Zyxel NAS326 (firmware v5.21(AAZF.14)C0 and earlier) and NAS542 (firmware v5.21(ABAG.11)C0 and earlier) where the function show_zysync_server_contents can be abused by an unauthenticated attacker to run OS commands via a crafted HTTP P...

CVE-2023-35138

A command injection vulnerability in the “showzysyncservercontents” function of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...

CVE-2023-35137

An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device...

CVE-2023-35137

The CVE-2023-35137 issue affects Zyxel NAS326 and NAS542 via an improper authentication flaw in the login/authentication component, enabling an unauthenticated attacker to obtain system information by sending a crafted URL. Affected firmware is Zyxel NAS326 V5.21(AAZF.14)C0 and NAS542 V5.21(ABAG....

PT-2023-7313 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 version V5.21AAZF.14C0 Zyxel NAS542 version V5.21ABAG.11C0 Description: A command injection issue exists in the show zysync server contents function, allowing an unauthenticated attacker to execute some operating system commands ...

Zyxel NAS326 Authorization Issues Vulnerability

Zyxel NAS326 is a cloud storage NAS from China Heqin Zyxel. An authorization issue vulnerability exists in Zyxel NAS326 V5.21AAZF.14C0 and NAS542 V5.21ABAG.11C0 and prior versions, which stems from the presence of an incorrect authentication vulnerability that could allow an unauthenticated...

Zyxel NAS326 Operating System Command Injection Vulnerability

Zyxel NAS326 is a cloud storage NAS from China Heqin Zyxel. An operating system command injection vulnerability exists in Zyxel NAS326 V5.21AAZF.14C0 and NAS542 V5.21ABAG.11C0 and earlier versions, which stems from the presence of a command injection vulnerability that could allow an...

PT-2023-7333 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 version V5.21AAZF.14C0 Zyxel NAS542 version V5.21ABAG.11C0 Description: The issue arises from the improper neutralization of special elements in the WSGI server, allowing an unauthenticated attacker to execute some operating syst...

Zyxel NAS326 Operating System Command Injection Vulnerability

Zyxel NAS326 is a cloud storage NAS from China Heqin Zyxel. An operating system command injection vulnerability exists in Zyxel NAS326 V5.21AAZF.14C0 and NAS542 V5.21ABAG.11C0 and prior versions, which stems from the presence of a post-authentication command injection vulnerability that could all...

Zyxel NAS326 Operating System Command Injection Vulnerability

Zyxel NAS326 is a cloud storage NAS from China Heqin Zyxel. An operating system command injection vulnerability exists in Zyxel NAS326 V5.21AAZF.14C0 and NAS542 V5.21ABAG.11C0 and prior versions, which stems from incorrect neutralization of a special element that could allow an authenticated...

PT-2023-7332 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 version V5.21AAZF.14C0 Zyxel NAS542 version V5.21ABAG.11C0 Description: A command injection issue exists in the web server of the Zyxel NAS326 and NAS542 firmware due to the lack of neutralization of special elements used in...