Vulnerabilities > Zyxel

DATE CVE VULNERABILITY TITLE RISK
2024-01-30 CVE-2023-5372 OS Command Injection vulnerability in Zyxel Nas326 Firmware and Nas542 Firmware
The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.
network
low complexity
zyxel CWE-78
7.2
2023-11-30 CVE-2023-35137 Improper Authentication vulnerability in Zyxel Nas326 Firmware and Nas542 Firmware
An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.
network
low complexity
zyxel CWE-287
7.5
2023-11-30 CVE-2023-35138 OS Command Injection vulnerability in Zyxel Nas326 Firmware and Nas542 Firmware
A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
network
low complexity
zyxel CWE-78
critical
9.8
2023-11-30 CVE-2023-37927 OS Command Injection vulnerability in Zyxel Nas326 Firmware and Nas542 Firmware
The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
network
low complexity
zyxel CWE-78
8.8
2023-11-30 CVE-2023-37928 OS Command Injection vulnerability in Zyxel Nas326 Firmware and Nas542 Firmware
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
network
low complexity
zyxel CWE-78
8.8
2023-11-30 CVE-2023-4473 OS Command Injection vulnerability in Zyxel Nas326 Firmware and Nas542 Firmware
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
network
low complexity
zyxel CWE-78
critical
9.8
2023-11-30 CVE-2023-4474 OS Command Injection vulnerability in Zyxel Nas326 Firmware and Nas542 Firmware
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
network
low complexity
zyxel CWE-78
critical
9.8
2023-11-28 CVE-2023-5797 Improper Privilege Management vulnerability in Zyxel products
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access the administrator’s logs on an affected device.
local
low complexity
zyxel CWE-269
5.5
2023-11-28 CVE-2023-5960 Improper Privilege Management vulnerability in Zyxel ZLD
An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device.
local
low complexity
zyxel CWE-269
5.5
2023-11-28 CVE-2023-35136 Improper Input Validation vulnerability in Zyxel ZLD
An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to access configuration files on an affected device.
local
low complexity
zyxel CWE-20
5.5