CVE-2023-35138

published 2023-11-30

CVE-2023-35138: A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
zyxel	nas326_firmware	<= 5.21\(aazf.14\)c0	—
zyxel	nas326_firmware	—	—
zyxel	nas542_firmware	<= 5.21\(abag.11\)c0	—
zyxel	nas542_firmware	—	—

CWE-78