NAS326 firmware vulnerabilities | LiveThreat CVE Feed

Product

NAS326 firmware

by Zyxel · last CVE Sep 10, 2024

On CISA KEVExploited in the wild

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities24 In the news0 Timeline

Severity mix

Critical 10High 10Medium 4Low 0

Severity

All severities24 Critical10 High10 Medium4 Low0

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add NAS326 firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-27992 In wildKEV	9.8	82%	Jun 19	Zyxel Multiple NAS Devices Command Injection Vulnerability Affected: < V5.21(AAZF.14)C0
CVE-2020-9054 In wildKEV	9.8	100%	Mar 4	ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi Affected: before 5.21\(aazf.10\)c0
CVE-2024-6342	9.8	2%	Sep 10	UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions… Affected: <= V5.21(AAZF.18)C0
CVE-2024-29974	9.8	23%	Jun 4	UNSUPPORTED WHEN ASSIGNED The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(aazf.17\)c0
CVE-2024-29973	9.8	86%	Jun 4	UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware… Affected: before 5.21\(aazf.17\)c0
CVE-2024-29972	9.8	90%	Jun 4	UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(aazf.17\)c0
CVE-2023-4474	9.8	30%	Nov 30	The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow… Affected: through 5.21\(aazf.14\)c0
CVE-2023-4473	9.8	41%	Nov 30	A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an… Affected: through 5.21\(aazf.14\)c0
CVE-2023-35138	9.8	40%	Nov 30	A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0… Affected: through 5.21\(aazf.14\)c0
CVE-2022-34747	9.8	2%	Sep 6	A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP… Affected: before 5.21\(aazf.12\)c0