CVE-2023-4474

Vulnerability

The improper neutralization of special elements in the WSGI server of Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 allows an unauthenticated attacker to execute arbitrary operating system (OS) commands by sending a crafted URL to the vulnerable device [1][2]. The flaw resides in the WSGI server component and requires no prior authentication or special configuration to be reachable.

Exploitation

An attacker only needs network access to the target NAS device. No authentication or user interaction is required. The exploitation sequence involves sending a specially crafted HTTP request containing OS command payloads in the URL to the WSGI server endpoint [1][2]. The server fails to sanitize the input, leading to command execution.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands on the affected NAS device. This can lead to full compromise of the device, including data exfiltration, installation of malware, and potential lateral movement within the network [1][2].

Mitigation

Zyxel released fixed firmware versions on November 16, 2023: V5.21(AAZF.15)C0 for NAS326 and V5.21(ABAG.12)C0 for NAS542 [1][2]. Users are strongly advised to update to these patched versions. No workaround is available; the only mitigation is applying the firmware update.