Description
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| NAS326 firmware | Zyxel / NAS326 firmware | < V5.21(AAZF.14)C0 | affected |
| NAS540 firmware | Zyxel / NAS540 firmware | < V5.21(AATB.11)C0 | affected |
| NAS542 firmware | Zyxel / NAS542 firmware | < V5.21(ABAG.11)C0 | affected |