Description
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| NAS326 | ZyXEL / NAS326 | >= V5.21(AAZF.7)C0, <= V5.21(AAZF.7)C0 | affected |
| NAS520 | ZyXEL / NAS520 | >= V5.21(AASZ.3)C0, <= V5.21(AASZ.3)C0 | affected |
| NAS540 | ZyXEL / NAS540 | >= V5.21(AATB.4)C0, <= V5.21(AATB.4)C0 | affected |
| NAS542 | ZyXEL / NAS542 | >= V5.21(ABAG.4)C0, <= V5.21(ABAG.4)C0 | affected |
| NSA210 | ZyXEL / NSA210 | all | affected |
| NSA220 | ZyXEL / NSA220 | all | affected |
| NSA220+ | ZyXEL / NSA220+ | all | affected |
| NSA221 | ZyXEL / NSA221 | all | affected |
| NSA310 | ZyXEL / NSA310 | >= V4.75(AALH.2)C0, <= V4.75(AALH.2)C0 | affected |
| NSA320 | ZyXEL / NSA320 | all | affected |
| NSA320S | ZyXEL / NSA320S | >= V4.75(AANV.2)C0, <= V4.75(AANV.2)C0 | affected |
| NSA325 | ZyXEL / NSA325 | >= V4.81(AAAJ.1)C0, <= V4.81(AAAJ.1)C0 | affected |
| NSA325v2 | ZyXEL / NSA325v2 | >= V4.81(AALS.1)C0, <= V4.81(AALS.1)C0 | affected |