description: A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
defaultStatus: unaffected
product: NAS326 firmware
vendor: Zyxel
versions:
status: affected, version: V5.21(AAZF.14)C0
}
{
defaultStatus: unaffected
product: NAS542 firmware
vendor: Zyxel
versions:
status: affected, version: V5.21(ABAG.11)C0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL