Zyxel has addressed a number of security points, together with three important ones that might enable an unauthenticated attacker to execute working system instructions on susceptible network-attached storage (NAS) units.
Zyxel NAS programs are used for storing information in a centralized location on the community. They’re designed for excessive volumes of information and supply options like information backup, media streaming, or custom-made sharing choices.
Typical Zyxel NAS customers embrace small to medium-sized companies looking for an answer that mixes information administration, distant work, and collaboration options, in addition to IT professionals establishing information redundancy programs, or videographers and digital artists working with massive recordsdata.
In a security bulletin right this moment, the seller warns of the next flaws impacting NAS326 units working model 5.21(AAZF.14)C0 and earlier, and NAS542 with model 5.21(ABAG.11)C0 and earlier.
- CVE-2023-35137: Improper authentication vulnerability in Zyxel NAS units’ authentication module, permitting unauthenticated attackers to acquire system data by way of a crafted URL. (high-severity rating of seven.5)
- CVE-2023-35138: Command injection flaw within the “show_zysync_server_contents” perform in Zyxel NAS units, allowing unauthenticated attackers to execute OS instructions by way of a crafted HTTP POST request. (critical-severity rating of 9.8)
- CVE-2023-37927: Vulnerability in Zyxel NAS units’ CGI program, enabling authenticated attackers to execute OS instructions with a crafted URL. (high-severity rating of 8.8)
- CVE-2023-37928: Publish-authentication command injection in Zyxel NAS units’ WSGI server, permitting authenticated attackers to execute OS instructions by way of a crafted URL. (high-severity rating of 8.8)
- CVE-2023-4473: Command injection flaw within the internet server of Zyxel NAS units, allowing unauthenticated attackers to execute OS instructions by way of a crafted URL. (critical-severity rating of 9.8)
- CVE-2023-4474: Vulnerability within the WSGI server of Zyxel NAS units, permitting unauthenticated attackers to execute OS instructions with a crafted URL. (critical-severity rating of 9.8)
Risk actors may exploit the vulnerabilities above to achieve unauthorized entry, execute some working system instructions, acquire delicate system data, or to take full management of the affected Zyxel NAS units.
To handle these dangers, customers of NAS326 are really helpful to improve to model V5.21(AAZF.15)C0 or later. Customers of NAS542 ought to improve their firmware to V5.21(ABAG.12)C0 or later, which repair the above flaws.
The vendor has offered no mitigation recommendation or workarounds, a firmware replace being the really helpful motion.
