CVE-2023-35137: High severity zyxel nas326 vulnerability
Published Nov 30, 2023
·Updated
An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.
Affected Software
4 affected components
All of the following
Zyxel NAS326<=5.21\(aazf.14\)c0
Zyxel NAS326
All of the following
Zyxel NAS542 firmware<=5.21\(abag.11\)c0
Zyxel NAS542 firmware
Remediation
Event History
Nov 30, 2023
CVE Published
01:25 AM
Data Sourced
01:25 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-35137?
The severity of CVE-2023-35137 is high with a CVSS score of 7.5.
2
How does CVE-2023-35137 affect Zyxel NAS326 firmware?
CVE-2023-35137 affects Zyxel NAS326 firmware version V5.21(AAZF.14)C0.
3
How does CVE-2023-35137 affect Zyxel NAS542 firmware?
CVE-2023-35137 affects Zyxel NAS542 firmware version V5.21(ABAG.11)C0.
4
How can an unauthenticated attacker exploit CVE-2023-35137?
An unauthenticated attacker can exploit CVE-2023-35137 by sending a crafted URL to a vulnerable device.
5
Is there a fix available for CVE-2023-35137?
Yes, Zyxel has released firmware updates to address the vulnerability. Please refer to the Zyxel Security Advisory for more information.