CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-27992
Critical (9.8) in Zyxel Multiple Network-Attached Storage (NAS) Devices. In CISA KEV since 2023-06-23. EPSS 82% chance of exploitation in the next 30 days.
The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
Severity
- EPSS
- 82% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2023-06-23, due 2023-07-14
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:nas326_firmware
- zyxel:nas540_firmware
- zyxel:nas542_firmware
References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27992