Eval Injection Vulnerability in Zyxel NAS 326
CVE-2019-10633

8.8HIGH

Key Information:

Vendor
Zyxel
Status
Nas326 Firmware
Vendor
CVE Published:
9 April 2019

Summary

An eval injection vulnerability exists in the Python web server routing on Zyxel NAS 326, affecting versions 5.21 and earlier. This flaw allows remote authenticated attackers to execute arbitrary code through specific APIs such as tjp6jp6y4, simZysh, and ck6fup6. Consequently, this can compromise the integrity and security of the affected system, posing a serious risk to users and their data.

References

http://maxwelldulin.com/BlogPost?post=3236967424
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.