CVE-2023-5372: OS Command Injection
The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5372?
CVE-2023-5372 is considered a high-severity vulnerability due to its potential to allow authenticated attackers to execute arbitrary commands.
How do I fix CVE-2023-5372?
To fix CVE-2023-5372, update Zyxel NAS326 firmware to versions above V5.21(AAZF.16)C0 or Zyxel NAS542 firmware to versions above V5.21(ABAG.13)C0.
Who is affected by CVE-2023-5372?
CVE-2023-5372 affects users of Zyxel NAS326 and NAS542 devices running specific firmware versions prior to the latest updates.
What type of vulnerability is CVE-2023-5372?
CVE-2023-5372 is classified as a post-authentication command injection vulnerability.
Can CVE-2023-5372 be exploited remotely?
CVE-2023-5372 requires authenticated access, meaning an attacker must already have administrator privileges to exploit the vulnerability.