CVE-2023-35138

Severity

CRITICAL

CVSS

9.8

EPSS

0.39998

Risk score

53.2

CISA KEV

PoC

Published

2023-11-30

Modified

2024-08-02

First seen

2026-08-08

Aliases

EUVD-2023-39168, GHSA-J6JV-PGMX-6FP3

Products

Zyxel:NAS326 firmware V5.21(AAZF.14)C0, Zyxel:NAS542 firmware V5.21(ABAG.11)C0

Sources

euvd EUVD-2023-39168

Description

A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39168
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products