Zyxel security advisory for pre-authentication command injection vulnerability in NAS products

CVE: CVE-2023-27992

Summary

Zyxel has released patches addressing a pre-authentication command injection vulnerability in some NAS versions. Users are advised to install them for optimal protection.

What is the vulnerability?

The pre-authentication command injection vulnerability in some Zyxel NAS devices could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

What versions are vulnerable—and what should you do?

After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period, with their firmware patches shown in the table below.

Got a question?

Please contact your local service rep or visit Zyxel’s community for further information or assistance.

Acknowledgment

Thanks to Andrej Zaujec, NCSC-FI, and Maxim Suslov for reporting the issue to us.

Revision history

2023-06-20: Initial release.