description: The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
defaultStatus: unaffected
product: NAS326 firmware
vendor: Zyxel
versions:
status: affected, version: < V5.21(AAZF.14)C0
}
{
defaultStatus: unaffected
product: NAS540 firmware
vendor: Zyxel
versions:
status: affected, version: < V5.21(AATB.11)C0
}
{
defaultStatus: unaffected
product: NAS542 firmware
vendor: Zyxel
versions:
status: affected, version: < V5.21(ABAG.11)C0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL