CVE-2022-34747

CRITICAL

Zyxel Nas326 Firmware - Format String Vulnerability

Title source: rule

Description

A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.

References (1)

[Patch, Vendor Advisory] https://www.zyxel.com/support/Zyxel-security-advisory-for-format-string-vulnerability-in-NAS.shtml

Scores

CVSS v3 9.8

EPSS 0.0278

EPSS Percentile 86.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-134

Status published

Products (1)

zyxel/nas326_firmware < 5.21\(aazf.12\)c0

Published Sep 06, 2022

Tracked Since Feb 18, 2026