CVE-2023-37927: OS Command Injection
First published: Thu Nov 30 2023(Updated: )
The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Credit: security@zyxel.com.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Zyxel NAS326 firmware | <=5.21\(aazf.14\)c0 | |
| Zyxel NAS326 | ||
| All of | ||
| Zyxel Nas542 Firmware | <=5.21\(abag.11\)c0 | |
| Zyxel NAS542 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
- https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
Frequently Asked Questions
What is CVE-2023-37927?
CVE-2023-37927 refers to the improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0, which could allow an authenticated attacker to execute operating system commands by sending a crafted URL.
What is the severity of CVE-2023-37927?
CVE-2023-37927 has a severity rating of 8.8 (high).
How does CVE-2023-37927 affect the Zyxel NAS326 firmware?
CVE-2023-37927 affects the Zyxel NAS326 firmware version V5.21(AAZF.14)C0, allowing an authenticated attacker to execute operating system commands through a crafted URL.
How does CVE-2023-37927 affect the Zyxel NAS542 firmware?
CVE-2023-37927 affects the Zyxel NAS542 firmware version V5.21(ABAG.11)C0, allowing an authenticated attacker to execute operating system commands through a crafted URL.
How can I fix CVE-2023-37927?
To fix CVE-2023-37927, it is recommended to update the Zyxel NAS326 firmware to a non-vulnerable version.
- collector/nvd-api
- agent/references
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/source
- vendor/zyxel
- canonical/zyxel nas326 firmware
- version/zyxel nas326 firmware/5.21\(aazf.14\)c0
- canonical/zyxel nas326
- canonical/zyxel nas542 firmware
- version/zyxel nas542 firmware/5.21\(abag.11\)c0
- canonical/zyxel nas542