CVE-2023-5372

HIGH

Zyxel NAS326/NAS542 < 5.21(AAZF.16)C0/< 5.21(ABAG.13)C0 Authenticated OS Command Injection

Title source: llm

Description

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024

Scores

CVSS v3 7.2

EPSS 0.1012

EPSS Percentile 93.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (2)

zyxel/nas326_firmware < 5.21\(aazf.16\)c0

zyxel/nas542_firmware < 5.21\(abag.13\)c0

Published Jan 30, 2024

Tracked Since Feb 18, 2026