Post-Authentication Command Injection Vulnerability in Zyxel NAS326 and NAS542

CVE-2023-37928

What is CVE-2023-37928?

A post-authentication command injection vulnerability exists in the WSGI server of Zyxel NAS326 and NAS542 firmware, allowing an authenticated attacker to execute arbitrary operating system commands. By crafting a malicious URL and exploiting this weakness, attackers can potentially compromise device integrity and access sensitive information. This vulnerability highlights the importance of securing firmware updates and maintaining robust authentication protocols.

References