NF
Product
NAS326 firmware
On CISA KEVExploited in the wild
24
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 10Medium 4Low 0
Watch
Add NAS326 firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-27992 In wildKEV | 9.8 | Jun 19 | Zyxel Multiple NAS Devices Command Injection Vulnerability Affected: < V5.21(AAZF.14)C0 |
| CVE-2020-9054 In wildKEV | 9.8 | Mar 4 | ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi Affected: before 5.21\(aazf.10\)c0 |
| CVE-2024-6342 | 9.8 | Sep 10 | **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions… Affected: <= V5.21(AAZF.18)C0 |
| CVE-2024-29974 | 9.8 | Jun 4 | ** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(aazf.17\)c0 |
| CVE-2024-29973 | 9.8 | Jun 4 | ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware… Affected: before 5.21\(aazf.17\)c0 |
| CVE-2024-29972 | 9.8 | Jun 4 | ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(aazf.17\)c0 |
| CVE-2023-4474 | 9.8 | Nov 30 | The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow… Affected: through 5.21\(aazf.14\)c0 |
| CVE-2023-4473 | 9.8 | Nov 30 | A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an… Affected: through 5.21\(aazf.14\)c0 |
| CVE-2023-35138 | 9.8 | Nov 30 | A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0… Affected: through 5.21\(aazf.14\)c0 |
| CVE-2022-34747 | 9.8 | Sep 6 | A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP… Affected: before 5.21\(aazf.12\)c0 |
| CVE-2023-37928 | 8.8 | Nov 30 | A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could… Affected: through 5.21\(aazf.14\)c0 |
| CVE-2023-37927 | 8.8 | Nov 30 | The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow… Affected: through 5.21\(aazf.14\)c0 |
| CVE-2020-13365 | 8.8 | Aug 6 | Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used for a TELNET session… Affected: before v5.21\(aazf.9\)c0 |
| CVE-2020-13364 | 8.8 | Aug 6 | A backdoor in certain Zyxel products allows remote TELNET access via a CGI script Affected: before v5.21\(aazf.9\)c0 |
| CVE-2019-10633 | 8.8 | Apr 9 | An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via… Affected: through 5.21 |
| CVE-2019-10631 | 8.8 | Apr 9 | Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different… Affected: through 5.21 |
| CVE-2019-10630 | 8.8 | Apr 9 | A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device Affected: through 5.21 |
| CVE-2023-35137 | 7.5 | Nov 30 | An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could… Affected: through 5.21\(aazf.14\)c0 |
| CVE-2023-5372 | 7.2 | Jan 30 | The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could… Affected: before 5.21\(aazf.16\)c0 |
| CVE-2023-27988 | 7.2 | May 30 | The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator… Affected: before 5.21\(aazf.13\)c0 |
| CVE-2024-29975 | 6.7 | Jun 4 | ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(aazf.17\)c0 |
| CVE-2024-29976 | 6.5 | Jun 4 | ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and… Affected: before 5.21\(aazf.17\)c0 |
| CVE-2019-10632 | 6.5 | Apr 9 | A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other… Affected: through 5.21 |
| CVE-2019-10634 | 5.4 | Apr 9 | An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share… Affected: through 5.21 |
Showing 24