CVE-2023-27988 HIGH

CVE-2023-27988

Vendor Zyxel
Product NAS326 firmware
Weakness CWE-78
Published May 30, 2023
Last update January 14, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.

Key dates

02Disclosure timeline

May 30, 2023 CVE published
January 14, 2025 Record updated