CVE-2023-35137

Thursday, November 30, 2023

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.

Affected Software

Vendor	Product	Version Range	Status
Zyxel	NAS326 firmware	`V5.21(AAZF.14)C0`	affected
Zyxel	NAS542 firmware	`V5.21(ABAG.11)C0`	affected

Weaknesses

CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CVE Program Container

Additional References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.