CVE-2023-4474
published 2023-11-30CVE-2023-4474: The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version…
PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
29.74%
98.0th percentile
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zyxel | nas326_firmware | <= 5.21\(aazf.14\)c0 | — |
| zyxel | nas326_firmware | — | — |
| zyxel | nas542_firmware | <= 5.21\(abag.11\)c0 | — |
| zyxel | nas542_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/cmd,/ck6fup6/time_machine_main/setTimeMachineStatus
path/cmd,/ck6fup6/zylog_main/show_logging_entries/
path/cmd,/ck6fup6/zylog_main/configure_mail_syslog/
path/cmd,/ck6fup6/portal_main/pkg_init_cmd/
path/cmd,/ck6fup6/
path/cmd,/ck6fup6/system_main/show_sysinfo/
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/time_machine_main/setTimeMachineStatus"; fast_pattern; startswith; pcre:"/(?:target_share|share_name)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052367; rev:1;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/show_logging_entries/"; fast_pattern; startswith; content:"type|3d|"; distance:0; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052363; rev:1;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/configure_mail_syslog/"; fast_pattern; startswith; pcre:"/(?:mailTo|mailFrom|mailServer|mailFormat|accountSMTP|passwdSMTP|scheduleDay|scheduleHour|scheduleMinute)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052364; rev:1;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/portal_main/pkg_init_cmd/"; fast_pattern; startswith; content:"pkgname|3d|"; distance:0; content:"cmd|3d|"; within:100; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052362; rev:1;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/"; fast_pattern; startswith; pcre:"/\/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4473; classtype:attempted-admin; sid:2052325; rev:3;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/system_main/show_sysinfo/"; fast_pattern; startswith; pcre:"/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4473; classtype:attempted-admin; sid:2052326; rev:2;)
- →Command injection payloads in URI parameters are identified by a semicolon (;, hex 0x3b) following parameter values — look for URI parameters such as target_share, share_name, type, mailTo, mailFrom, mailServer, pkgname, cmd containing a semicolon as a shell injection delimiter.
- →For the pkg_init_cmd endpoint, injection is signalled by the presence of both 'pkgname=' and 'cmd=' parameters followed by a semicolon (0x3b) within 100 bytes — monitor HTTP URIs matching this pattern.
- →For the show_logging_entries endpoint, injection is signalled by a 'type=' parameter followed by a semicolon (0x3b) within 100 bytes in the URI.
- →For the configure_mail_syslog endpoint, injection is signalled by mail/schedule-related parameters (mailTo, mailFrom, mailServer, mailFormat, accountSMTP, passwdSMTP, scheduleDay, scheduleHour, scheduleMinute) followed by a semicolon in the URI.
- →The authentication bypass (CVE-2023-4473) abuses the WSGI path prefix /cmd,/ck6fup6/ — any HTTP request with a URI starting with this prefix and matching known bypass sub-paths (e.g., favicon.ico, weblogin.cgi, login.html, setCookie) should be treated as suspicious.
- →The vulnerability is exploitable by unauthenticated attackers via a crafted URL to the WSGI server — prioritize perimeter and internal network monitoring for these URI patterns on HTTP traffic.
- ·Affected firmware versions are specifically NAS326 V5.21(AAZF.14)C0 and NAS542 V5.21(ABAG.11)C0 — detections should be scoped to these device types and versions where asset inventory is available.
- ·The Snort/ET rules are marked tls_state plaintext — these signatures will NOT fire on TLS-encrypted traffic; ensure inspection is performed on plaintext HTTP sessions only.
- ·The ET rules reference both CVE-2023-4474 and CVE-2024-4474 — verify the correct CVE mapping for your environment, as the rule metadata may conflate two distinct CVE identifiers.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h9w9-8x3q-c9vg: The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5
ghsa_unreviewed·2023-11-30
CVE-2023-4474 [CRITICAL] CWE-78 GHSA-h9w9-8x3q-c9vg: The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
VulnCheck
Zyxel nas326_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2023·CVSS 9.8
CVE-2023-4474 [CRITICAL] Zyxel nas326_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Zyxel nas326_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Affected: Zyxel nas326_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://isc.sans.edu/diary/Another+Day+Another+NAS+Attacks+against+Zyxel+NAS326+devices+CVE20234473+CVE20234474/30884
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/time_machine_main/setTimeMachineStatus"; fast_pattern; startswith; pcre:"/(?:target_share|share_name)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052367; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_4474, deployment Perimete
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/show_logging_entries/"; fast_pattern; startswith; content:"type|3d|"; distance:0; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052363; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_4474, deployment Per
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/configure_mail_syslog/"; fast_pattern; startswith; pcre:"/(?:mailTo|mailFrom|mailServer|mailFormat|accountSMTP|passwdSMTP|scheduleDay|scheduleHour|scheduleMinute)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052364; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/portal_main/pkg_init_cmd/"; fast_pattern; startswith; content:"pkgname|3d|"; distance:0; content:"cmd|3d|"; within:100; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052362; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CV
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zypkg_main/pkg_"; fast_pattern; startswith; pcre:"/(?:disable|install)/R"; content:"pkgname|3d|"; distance:0; content:"|3b|"; within:100; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052366; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_447
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4
suricata·2024-05-02·CVSS 4.3
CVE-2023-4474 [MEDIUM] ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/zylog_main/test_mail/"; fast_pattern; startswith; pcre:"/(?:to|server|from|user|passwd)\x3d.*\x3b/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4474; reference:cve,2024-4474; classtype:attempted-admin; sid:2052365; rev:1; metadata:affected_product Zyxel, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_05_02, cve CVE_2024_4474, deployment Perimeter, deployment
Suricata
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo
suricata·2024-05-01·CVSS 9.8
CVE-2023-4473 [CRITICAL] ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/system_main/show_sysinfo/"; fast_pattern; startswith; pcre:"/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyx
Suricata
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)
suricata·2024-05-01·CVSS 9.8
CVE-2023-4473 [CRITICAL] ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)
ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)"; flow:established,to_server; http.uri; content:"/cmd,/ck6fup6/"; fast_pattern; startswith; pcre:"/\/(?:favicon.ico|adv,\/cgi-bin\/weblogin\.cgi|desktop,\/(?:file_download\.cgi|cgi-bin\/dlnotify|login\.html|res\/|css\/|utility\/flag\/js)|MyWeb\/|register_main\/setCookie|playzone,\/(?:mobile_login\.html|mobile\/sencha\/|mobile\/images\/|images\/))/R"; reference:url,bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; reference:cve,2023-4473; classtype:attempted-admin; sid:2052325; rev:3;
No public exploits indexed.
Checkpoint
4th December – Threat Intelligence Report
blogs_checkpoint·2023-12-04·CVSS 7.5
CVE-2023-4966 [HIGH] 4th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 4th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 4th December, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Check Point Research provides highlights about Cyber Av3ngers group activity, which has taken responsibility on defacing workstations at Pennsylvania’s Aliquippa municipal water authority. Following the attack, CISA has published an advisory about this hacktivists group which is affiliated to Iranian Revolutionary Guard C
Bleepingcomputer
Zyxel warns of multiple critical vulnerabilities in NAS devices
blogs_bleepingcomputer·2023-11-30·CVSS 7.5
[HIGH] Zyxel warns of multiple critical vulnerabilities in NAS devices
## Zyxel warns of multiple critical vulnerabilities in NAS devices
## Bill Toulas
Zyxel has addressed multiple security issues, including three critical ones that could allow an unauthenticated attacker to execute operating system commands on vulnerable network-attached storage (NAS) devices.
Zyxel NAS systems are used for storing data in a centralized location on the network. They are designed for high volumes of data and offer features like data backup, media streaming, or customized sharing options.
Typical Zyxel NAS users include small to medium-sized businesses seeking a solution that combines data management, remote work, and collaboration features, as well as IT professionals setting up data redundancy systems, or videographers and digital artists working with large files.
In a
https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-productshttps://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
2023-11-30
Published
Exploited in the wild