CVE-2023-37928CWE-78

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version…

High · published November 30, 2023

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1
8.8
EPSS
60%
Percentile
99.1
In the wild
Unconfirmed
What it is

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.60200 · 99.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-11-30T01:37Z
EPSS history
Timeline
  • 30 NOV 01:37Z
    A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version…
    cvelistv5