ZeroDay Findings
Sign inSign up

Findings

CVE-2023-27992

Zyxel Multiple NAS Devices Command Injection Vulnerability

Published Jun 19, 2023 · updated Jun 16, 2026 · zyxel nas326 firmware

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 19, 2023 · Catalog

    Detected

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

  2. Jun 23, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 14, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

Required action

Apply updates per vendor instructions.

CISA due date Jul 14, 2023

Affected

  • cpe zyxel/nas326 firmwareversion unspecified
  • cpe zyxel/nas540 firmwareversion unspecified
  • cpe zyxel/nas542 firmwareversion unspecified
  • vendor Zyxel Multiple Network-Attached Storage (NAS) Devicesversion unspecified

Sources

  • CISA KEVCVE-2023-27992

    Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.

    cisa.gov
  • CVE.orgCVE-2023-27992

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-27992

    30-day exploitation probability 82.8%

    first.org
  • NIST NVDCVE-2023-27992

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute so

    nvd.nist.gov

References