CVE-2023-5372

Deeper analysis

The vulnerability CVE-2023-5372 is a post-authentication command injection issue, tracked under CWE-78, that affects the web management interface of Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0. An authenticated administrator can supply a specially crafted query parameter in a URL request to cause the device to execute arbitrary operating system commands.

An attacker who already possesses valid administrator credentials on an exposed device can leverage this flaw over the network to achieve full control of the underlying operating system, including the ability to read, modify, or delete data and potentially pivot further into the environment. The CVSS 3.1 score of 7.2 reflects the high impact on confidentiality, integrity, and availability when the attack succeeds.

Zyxel’s security advisory published on 30 January 2024 addresses the issue in the affected NAS products and directs administrators to apply the available firmware updates or configuration changes referenced in the advisory to eliminate the command-injection vector. The associated EPSS values remain near 0.10 with negligible movement between the recorded peak and current figures.