Lucene search

ZyxelVULNRICHMENT:CVE-2023-5372

HistoryJan 30, 2024 - 12:55 a.m.

CVE-2023-5372

2024-01-3000:55:33

CWE-78

Zyxel

github.com

zyxel

nas326

nas542

firmware

command injection

vulnerability

authenticated attacker

administrator privileges

os commands

web management interface

cve-2023-5372

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "zyxel",
    "product": "nas326_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "5.21(AAZF.15)C0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "zyxel",
    "product": "nas542_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "5.21(ABAG.12)C0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2023-5372