CVE-2023-35138

Deeper analysis

CVE-2023-35138 is a command injection vulnerability (CWE-78) residing in the show_zysync_server_contents function of Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0. The flaw permits an unauthenticated remote attacker to supply a crafted HTTP POST request that results in execution of arbitrary operating-system commands on the affected network-attached storage devices. It carries a CVSS 3.1 base score of 9.8.

An unauthenticated attacker with network access can exploit the issue by sending a maliciously formed POST request to the vulnerable endpoint; successful exploitation grants the attacker the ability to run arbitrary OS commands, potentially leading to full device compromise, data exfiltration, or use of the NAS as a foothold for further attacks.

Zyxel’s security advisory addresses both this command-injection issue and a related authentication-bypass vulnerability in the same NAS product line, directing administrators to apply the vendor-supplied firmware updates that remediate the flaws.

The associated EPSS score has reached a peak of 0.1052 with a current value of 0.0960, indicating moderate and relatively stable exploitation interest since disclosure.