CVE-2023-5372

high · 7.2

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.

7.2

CVSS

28.5%

EPSS (exploit prob.)

98th

EPSS percentile

2024-01-30

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
zyxel	nas326_firmware	< 5.21\(aazf.16\)c0
zyxel	nas326	all versions
zyxel	nas542_firmware	< 5.21\(abag.13\)c0
zyxel	nas542	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-5372