VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Nov 30, 2023· Updated Jun 17, 2026

CVE-2023-35138

CVE-2023-35138

Description

A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Zyxel/Nas326 Firmware2 versions
    cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*range: <=5.21\(aazf.14\)c0
    • (no CPE)range: V5.21(AAZF.14)C0
  • Zyxel/Nas542 Firmware2 versions
    cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*range: <=5.21\(abag.11\)c0
    • (no CPE)range: V5.21(ABAG.11)C0
  • Zyxel/NAS326llm-fuzzy
    Range: V5.21(AAZF.14)C0
  • Zyxel/NAS542llm-fuzzy
    Range: V5.21(ABAG.11)C0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.