Post-Authentication Command Injection in Zyxel NAS326 Firmware

CVE-2023-27988

What is CVE-2023-27988?

Zyxel NAS326 devices running firmware versions before V5.21(AAZF.13)C0 are susceptible to a post-authentication command injection vulnerability. This security flaw enables an authenticated attacker with administrative access to execute arbitrary operating system commands remotely on the affected device, potentially compromising its integrity and security. Proper mitigations and updates are crucial to safeguard against this vulnerability.

References