CVE-2023-27992

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 82,8%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada zyxel nas326 firmware, zyxel nas540 firmware +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut zyxel.com.tw. Masuk katalog KEV CISA pada 23 Juni 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

Rincian

Terbit di NVD

19 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber zyxel.com.tw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

82,8% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Zyxel Multiple NAS Devices Command Injection Vulnerability

Masuk KEV

23 Juni 2023

Tenggat CISA

14 Juli 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-com... patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27992 pemerintah AS