Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-35138

A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 c

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zyxel

Description

A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zyxel NAS326 firmware

Default version status: unaffected

  • V5.21(AAZF.14)C0affected

Zyxel NAS542 firmware

Default version status: unaffected

  • V5.21(ABAG.11)C0affected

References