CVE-2023-4473
published 2023-11-30CVE-2023-4473: A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could…
PriorityP190critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
41.35%
98.5th percentile
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zyxel | nas326_firmware | <= 5.21\(aazf.14\)c0 | — |
| zyxel | nas326_firmware | — | — |
| zyxel | nas542_firmware | <= 5.21\(abag.11\)c0 | — |
| zyxel | nas542_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/cmd,/ck6fup6/
path/cmd,/ck6fup6/system_main/show_sysinfo/
path/cmd,/ck6fup6/portal_main/pkg_init_cmd/
path/cmd,/ck6fup6/zylog_main/show_logging_entries/
path/cmd,/ck6fup6/zylog_main/configure_mail_syslog/
path/cmd,/ck6fup6/time_machine_main/setTimeMachineStatus
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/"; fast_pattern; startswith; pcre:"/\/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4473; classtype:attempted-admin; sid:2052325; rev:3;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/system_main/show_sysinfo/"; fast_pattern; startswith; pcre:"/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4473; classtype:attempted-admin; sid:2052326; rev:2;)
- →Authentication bypass (CVE-2023-4473) is detectable by HTTP requests to the /cmd,/ck6fup6/ URI prefix combined with paths normally accessible without authentication (e.g., favicon.ico, weblogin.cgi, login.html, setCookie, mobile paths). Match the broad URI prefix rule (sid:2052325) or the narrower show_sysinfo variant (sid:2052326).
- →Command injection payloads (related chained CVE-2023-4474 / CVE-2024-4474) are identified by a semicolon (0x3b) appearing in URI parameters such as pkgname/cmd, type, mailTo/mailFrom/mailServer, or target_share/share_name — indicating OS command chaining.
- →For the pkg_init_cmd endpoint, look for both 'pkgname=' and 'cmd=' parameters in the URI followed by a semicolon within 100 bytes, indicating command injection (sid:2052362).
- →For the show_logging_entries endpoint, detect 'type=' parameter followed by a semicolon within 100 bytes as the injection indicator (sid:2052363).
- →For the configure_mail_syslog endpoint, use a PCRE to detect any of the mail/schedule parameters (mailTo, mailFrom, mailServer, mailFormat, accountSMTP, passwdSMTP, scheduleDay, scheduleHour, scheduleMinute) followed by '=' and then a semicolon (sid:2052364).
- →For the setTimeMachineStatus endpoint, detect target_share or share_name parameters followed by a semicolon using PCRE (sid:2052367).
- →All attack traffic is expected in plaintext (tls_state plaintext); deploy detection rules at the network perimeter and internally.
- ·CVE-2023-4473 affects only specific firmware versions: Zyxel NAS326 V5.21(AAZF.14)C0 and NAS542 V5.21(ABAG.11)C0. Detection rules should be scoped to these device types. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2h5j-5qmh-v4qh: A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5
ghsa_unreviewed·2023-11-30
CVE-2023-4473 [CRITICAL] CWE-78 GHSA-2h5j-5qmh-v4qh: A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
VulnCheck
Zyxel nas326_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2023·CVSS 9.8
CVE-2023-4473 [CRITICAL] Zyxel nas326_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Zyxel nas326_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Affected: Zyxel nas326_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-28&host_type=src&vulnerability=cve-2023-4473; https://dashboard.shadowserver.org/statistics/honey
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/time_machine_main/setTimeMachineStatus"; fast_pattern; startswith; pcre:"/(?:target_share|share_name)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052367; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_4474, deployment Perimete
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/show_logging_entries/"; fast_pattern; startswith; content:"type|3d|"; distance:0; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052363; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_4474, deployment Per
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/configure_mail_syslog/"; fast_pattern; startswith; pcre:"/(?:mailTo|mailFrom|mailServer|mailFormat|accountSMTP|passwdSMTP|scheduleDay|scheduleHour|scheduleMinute)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052364; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/portal_main/pkg_init_cmd/"; fast_pattern; startswith; content:"pkgname|3d|"; distance:0; content:"cmd|3d|"; within:100; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052362; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CV
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zypkg_main/pkg_"; fast_pattern; startswith; pcre:"/(?:disable|install)/R"; content:"pkgname|3d|"; distance:0; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052366; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_447
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/test_mail/"; fast_pattern; startswith; pcre:"/(?:to|server|from|user|passwd)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052365; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_4474, deployment Perimeter, deployment
Suricata
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo
suricata·2024-05-01·CVSS 9.8
CVE-2023-4473 [CRITICAL] ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/system_main/show_sysinfo/"; fast_pattern; startswith; pcre:"/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyx
Suricata
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)
suricata·2024-05-01·CVSS 9.8
CVE-2023-4473 [CRITICAL] ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/"; fast_pattern; startswith; pcre:"/\/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4473; classtype:attempted-admin; sid:2052325; rev:3;
No public exploits indexed.
Checkpoint
4th December – Threat Intelligence Report
blogs_checkpoint·2023-12-04·CVSS 7.5
CVE-2023-4966 [HIGH] 4th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 4th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 4th December, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Check Point Research provides highlights about Cyber Av3ngers group activity, which has taken responsibility on defacing workstations at Pennsylvania’s Aliquippa municipal water authority. Following the attack, CISA has published an advisory about this hacktivists group which is affiliated to Iranian Revolutionary Guard C
Bleepingcomputer
Zyxel warns of multiple critical vulnerabilities in NAS devices
blogs_bleepingcomputer·2023-11-30·CVSS 7.5
[HIGH] Zyxel warns of multiple critical vulnerabilities in NAS devices
## Zyxel warns of multiple critical vulnerabilities in NAS devices
## Bill Toulas
Zyxel has addressed multiple security issues, including three critical ones that could allow an unauthenticated attacker to execute operating system commands on vulnerable network-attached storage (NAS) devices.
Zyxel NAS systems are used for storing data in a centralized location on the network. They are designed for high volumes of data and offer features like data backup, media streaming, or customized sharing options.
Typical Zyxel NAS users include small to medium-sized businesses seeking a solution that combines data management, remote work, and collaboration features, as well as IT professionals setting up data redundancy systems, or videographers and digital artists working with large files.
In a
https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-productshttps://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
2023-11-30
Published
Exploited in the wild