Zyxel Multiple NAS Devices Command Injection Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jun 19, 2023 · Catalog

   Detected

   The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

2. Jun 23, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jul 14, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

Affected

• cpe zyxel/nas326 firmwareversion unspecified
• cpe zyxel/nas540 firmwareversion unspecified
• cpe zyxel/nas542 firmwareversion unspecified
• vendor Zyxel Multiple Network-Attached Storage (NAS) Devicesversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2023-27992

  Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.

  cisa.gov
• CVE.orgVulnerability recordCVE-2023-27992

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-27992

  30-day exploitation probability 82.8%

  first.org
• NIST NVDVulnerability recordCVE-2023-27992

  The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute so

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• CISA note · zyxel.com