CVE-2023-27988

Vulnerability

A post-authentication command injection vulnerability exists in the web management interface of Zyxel NAS326 devices. The issue affects firmware versions prior to V5.21(AAZF.13)C0. An authenticated attacker with administrator privileges can exploit this flaw to inject arbitrary operating system commands. [1]

Exploitation

To exploit the vulnerability, an attacker must first obtain valid administrator credentials for the NAS326 device. Once authenticated, the attacker can send crafted HTTP requests to the web management interface, which fails to properly sanitize user input, allowing injection of OS commands. The commands are executed with the privileges of the web server process, typically root. [1]

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands remotely on the affected device. This can lead to full compromise of the NAS, including data exfiltration, modification, or denial of service. The attacker gains complete control over the device. [1]

Mitigation

Zyxel has released firmware version V5.21(AAZF.13)C0 to address this vulnerability. Users are advised to update their NAS326 devices to this version or later. No workarounds are available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. [1]