CVE-2023-27992
Assigner: Zyxel
Published: 2023-06-19T11:42:41.774Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: NAS326 firmware
vendor: Zyxel
versions: status: affected
version: < V5.21(AAZF.14)C0
defaultStatus: unaffected
product: NAS540 firmware
vendor: Zyxel
versions: status: affected
version: < V5.21(AATB.11)C0
defaultStatus: unaffected
product: NAS542 firmware
vendor: Zyxel
versions: status: affected
version: < V5.21(ABAG.11)C0
descriptions: supportingMedia: base64: no
type: text/html
value: The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to&nbsp;V5.21(AAZF.14)C0, NAS540 firmware versions prior to&nbsp;V5.21(AATB.11)C0, and NAS542&nbsp;firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
value: The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev