CVE-2023-5372

CVSS V2 None CVSS V3 None

Description

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.

Overview

CVE ID
CVE-2023-5372

Assigner
Zyxel

Vulnerability Status
PUBLISHED

Published Version
2024-01-30T00:55:33.090Z

Last Modified Date
2024-01-30T00:55:33.090Z

Weakness Enumerations

CWE	URL
CWE-78	http://cwe.mitre.org/data/definitions/78.html

References

Reference URL	Reference Tags
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024	vendor-advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-5372
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5372

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 05:08:55				Added to TrackCVE