{"id":"CVE-2023-27992","kind":"vulnerability","aliases":["CVE-2023-27992"],"related":[],"title":"The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to…","description":"The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.","summary":"Multiple Zyxel NAS devices have a command injection flaw reachable over HTTP before login. An unauthenticated attacker can run arbitrary commands on the device by sending a crafted request.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-06-23T00:00:00+00:00","products":[{"name":"Zyxel Multiple Network-Attached Storage (NAS) Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel nas326 firmware","fixed":["5.21\\(aazf.14\\)c0"],"affected":"< 5.21\\(aazf.14\\)c0","ecosystem":"vendor"},{"name":"zyxel nas540 firmware","fixed":["5.21\\(aatb.11\\)c0"],"affected":"< 5.21\\(aatb.11\\)c0","ecosystem":"vendor"},{"name":"zyxel nas542 firmware","fixed":["5.21\\(abag.11\\)c0"],"affected":"< 5.21\\(abag.11\\)c0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","nas","self-hosted","zyxel"],"not_affected_if":["unknown"],"how_to_check":"Identify Zyxel NAS models in use and compare firmware against the vendor advisory; the sources do not give a version or a check command.","fix":"Apply the firmware update per the vendor's instructions (CISA KEV required action); the sources do not name the fixed version.","status":"open","published_at":"2023-06-19T12:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:30+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:06:30Z","model":"claude-haiku-5-5","output":{"fix":"Apply the firmware update per the vendor's instructions (CISA KEV required action); the sources do not name the fixed version.","reach":"internet","impact":"high","summary":"Multiple Zyxel NAS devices have a command injection flaw reachable over HTTP before login. An unauthenticated attacker can run arbitrary commands on the device by sending a crafted request.","category":"infrastructure","who_cares":["zyxel","nas","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary commands on the NAS device.","analyst_note":"Find affected model list and fixed firmware versions in the Zyxel advisory for CVE-2023-27992; the KEV entry does not name them.","how_to_check":"Identify Zyxel NAS models in use and compare firmware against the vendor advisory; the sources do not give a version or a check command.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000473,"input_tokens":2850,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':16A,19A '-27992':17A,20A 'aatb.11':98C 'aazf.14':90C 'abag.11':107C 'allow':110C 'arbitrari':64B 'attached':25A 'attack':61B,113C 'authent':4A,77C 'c0':91C,99C,108C 'command':5A,51B,65B,78C,120C 'could':109C 'craft':72B,125C 'cve':15A,18A 'devic':48B,68B 'devices':28A 'execut':115C 'exploit':38B 'firmwar':12A,85C,93C,102C 'firmware':31A,34A,37A 'flaw':53B 'host':43B 'http':56B,126C 'infrastructur':39B 'inject':6A,52B,79C 'login':58B 'multipl':45B 'multiple':22A 'nas':27A,40B,47B 'nas326':11A,30A,84C 'nas540':33A,92C 'nas542':36A,101C 'network':24A 'network-attached':23A 'oper':117C 'os':119C 'pre':3A,76C 'pre-authent':2A,75C 'prior':14A,87C,95C,104C 'reachabl':54B 'remot':121C 'request':73B,127C 'run':63B 'self':42B 'self-host':41B 'send':70B,123C 'storage':26A 'system':118C 'unauthent':60B,112C 'v5.21':89C,97C,106C 'version':13A,86C,94C,103C 'vulner':7A,80C 'zyxel':10A,21A,29A,32A,35A,44B,46B,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-06-19T12:15:09+00:00","kev":{"dateAdded":"2023-06-23","dueDate":"2023-07-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@zyxel.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-27992","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992","severity":null,"published_at":"2023-06-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-27992","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27992","severity":null,"published_at":"2023-06-19T12:15:09+00:00","modified_at":"2026-06-17T05:46:20+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}