CVE-2023-35138

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 40.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-30 · updated 2026-06-17
Weakness: CWE-78

Description

A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Affected products

Zyxel NAS326 firmware: through 5.21\(aazf.14\)c0
Zyxel NAS542 firmware: through 5.21\(abag.11\)c0

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products

Get alerted when CVE-2023-35138 or the next vulnerability affects your stack