What are you looking for ?
Infinidat
FMS

Zyxel Security Advisory for Post-Authentication Command Injection Vulnerability in NAS

Users advised to install patches for optimal protection

Zyxel Networks Corp. has released patches addressing a post-authentication command injection vulnerability in some NAS versions. Users are advised to install them for optimal protection.

CVE: CVE-2023-27988

What is the vulnerability?
The post-authentication command injection vulnerability has been found in the web management interface of some NAS versions. An authenticated attacker with administrator privileges could leverage this vulnerability to execute some OS commands on an affected device remotely.

What versions are vulnerable – and what should you do?
After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period, with their firmware patches shown in the table below.

Affected model

Affected version

Patch availability

NAS326

V5.21(AAZF.12)C0 and earlier

V5.21(AAZF.13)C0

NAS540

V5.21(AATB.9)C0 and earlier

V5.21(AATB.10)C0

NAS542

V5.21(ABAG.9)C0 and earlier

V5.21(ABAG.10)C0

Got a question?
Contact your local service rep or visit Zyxel’s Community for further information or assistance.

Acknowledgment
Thanks to Noam Zhitomirsky, Reuven Yakar, Dean Zavadski, and Amit Serper from Sternum and Sternum LIV for reporting the issue to us.

Revision history
2023-5-30: Initial release.

Articles_bottom
ExaGrid
AIC
ATTOtarget="_blank"
OPEN-E
DapuStor