CVE-2023-37928

Vulnerability

CVE-2023-37928 is a post-authentication command injection vulnerability in the WSGI server of Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0. The vulnerability arises from improper neutralization of special elements in the WSGI server, allowing an authenticated attacker to inject OS commands through a crafted URL [1][2]. The affected products are within their vulnerability support period [2].

Exploitation

An attacker must first authenticate to the NAS device. After authentication, the attacker sends a specially crafted URL to the vulnerable WSGI server, which executes arbitrary OS commands. No additional user interaction is required beyond the initial authentication [1][2]. The disclosure timeline indicates that this vulnerability was reported after an incomplete fix for a previous CVE [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands on the device. This can lead to full system compromise, including privilege escalation, data exfiltration, and potential lateral movement within the network [1][2].

Mitigation

Zyxel released firmware version V5.21(AAZF.15)C0 on November 16, 2023, which fixes this vulnerability [2]. Users are advised to update their NAS devices to the latest firmware. No workarounds are available for unpatched devices [1][2].