Post-Authentication Command Injection Vulnerability in Zyxel NAS Products

CVE-2023-5372

Summary

An authenticated post-authentication command injection vulnerability exists in the Zyxel NAS326 and NAS542 firmware, allowing attackers with administrator privileges to execute arbitrary operating system commands. This exploitation can be achieved by navigating to the web management interface of an affected device and sending a specially crafted query parameter within the URL. The affected firmware versions enhance the risk by not adequately validating input, thereby providing a potential attack vector for malicious actors.

References