CVE-2023-35137

published 2023-11-30

CVE-2023-35137: An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
zyxel	nas326_firmware	<= 5.21\(aazf.14\)c0	—
zyxel	nas326_firmware	—	—
zyxel	nas542_firmware	<= 5.21\(abag.11\)c0	—
zyxel	nas542_firmware	—	—

CWE-287