Live › vulnerability › CVE-2023-27992
Go to dashboardMultiple Zyxel NAS devices have a command injection flaw reachable over HTTP before login. An unauthenticated attacker can run arbitrary commands on the device by sending a crafted request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zyxel Multiple Network-Attached Storage (NAS) Devices | vendor | – | – |
| zyxel nas326 firmware | vendor | < 5.21\(aazf.14\)c0 | 5.21\(aazf.14\)c0 |
| zyxel nas540 firmware | vendor | < 5.21\(aatb.11\)c0 | 5.21\(aatb.11\)c0 |
| zyxel nas542 firmware | vendor | < 5.21\(abag.11\)c0 | 5.21\(abag.11\)c0 |
Identify Zyxel NAS models in use and compare firmware against the vendor advisory; the sources do not give a version or a check command.
Apply the firmware update per the vendor's instructions (CISA KEV required action); the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
This page as .md · .json · in your agent: get_signal("CVE-2023-27992")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.