CVE-2023-27988

HIGH

Zyxel NAS326 Firmware < 5.21(AAZF.13)C0 - Authenticated OS Command Injection

Title source: llm

Description

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.

References (1)

Core 1

Core References

Patch, Vendor Advisory

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products

Scores

CVSS v3 7.2

EPSS 0.0052

EPSS Percentile 66.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (3)

zyxel/nas326_firmware < 5.21\(aazf.13\)c0

zyxel/nas540_firmware < 5.21\(aatb.10\)c0

zyxel/nas542_firmware < 5.21\(abag.10\)c0

Published May 30, 2023

Tracked Since Feb 18, 2026