Zyxel · Multiple Network-Attached Storage (NAS) Devices
CVE-2023-27992
Zyxel Multiple NAS Devices Command Injection Vulnerability
What it is
The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
CISA: Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 14, 2023
More exploited flaws from Zyxel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 25, 2022 | Multiple NAS Devices OS Command Injection | Multiple Network-Attached Storage (NAS) Devices | Critical 9.8 | >99.9% |
| Sep 21, 2026 | Stack-Based Buffer Overflow | GS1900 Series Switches | High 8.8 | 2.8% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 21% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 23% |
| Dec 3, 2024 | Path Traversal | Multiple Firewalls | High 7.5 | 2.9% |
| Sep 18, 2023 | Command Injection | EMG2926 Routers | High 8.8 | 33% |
| Aug 7, 2023 | Command Injection | P660HN-T1A Routers | Critical 9.8 | 95% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 28% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.