---
id: "CVE-2023-27992"
kind: "vulnerability"
aliases: ["CVE-2023-27992"]
title: "The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Zyxel Multiple Network-Attached Storage (NAS) Devices", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "zyxel nas326 firmware", "fixed": ["5.21\\(aazf.14\\)c0"], "affected": "< 5.21\\(aazf.14\\)c0", "ecosystem": "vendor"}, {"name": "zyxel nas540 firmware", "fixed": ["5.21\\(aatb.11\\)c0"], "affected": "< 5.21\\(aatb.11\\)c0", "ecosystem": "vendor"}, {"name": "zyxel nas542 firmware", "fixed": ["5.21\\(abag.11\\)c0"], "affected": "< 5.21\\(abag.11\\)c0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nas", "self-hosted", "zyxel"]
not_affected_if: ["unknown"]
published_at: "2023-06-19T12:15:09+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27992", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to…

Multiple Zyxel NAS devices have a command injection flaw reachable over HTTP before login. An unauthenticated attacker can run arbitrary commands on the device by sending a crafted request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zyxel Multiple Network-Attached Storage (NAS) Devices affected ? fixed ?
- vendor:zyxel nas326 firmware affected < 5.21\(aazf.14\)c0 fixed 5.21\(aazf.14\)c0
- vendor:zyxel nas540 firmware affected < 5.21\(aatb.11\)c0 fixed 5.21\(aatb.11\)c0
- vendor:zyxel nas542 firmware affected < 5.21\(abag.11\)c0 fixed 5.21\(abag.11\)c0

## How to check

Identify Zyxel NAS models in use and compare firmware against the vendor advisory; the sources do not give a version or a check command.

## Fix

Apply the firmware update per the vendor's instructions (CISA KEV required action); the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-27992

## From the sources

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_