Zyxel has addressed a number of safety points, together with three essential ones that might enable an unauthenticated attacker to execute working system instructions on susceptible network-attached storage (NAS) units.
Zyxel NAS programs are used for storing knowledge in a centralized location on the community. They’re designed for excessive volumes of knowledge and supply options like knowledge backup, media streaming, or custom-made sharing choices.
Typical Zyxel NAS customers embody small to medium-sized companies searching for an answer that mixes knowledge administration, distant work, and collaboration options, in addition to IT professionals establishing knowledge redundancy programs, or videographers and digital artists working with massive information.
In a safety bulletin as we speak, the seller warns of the next flaws impacting NAS326 units operating model 5.21(AAZF.14)C0 and earlier, and NAS542 with model 5.21(ABAG.11)C0 and earlier.
- CVE-2023-35137: Improper authentication vulnerability in Zyxel NAS units’ authentication module, permitting unauthenticated attackers to acquire system data by way of a crafted URL. (high-severity rating of seven.5)
- CVE-2023-35138: Command injection flaw within the “show_zysync_server_contents” perform in Zyxel NAS units, allowing unauthenticated attackers to execute OS instructions via a crafted HTTP POST request. (critical-severity rating of 9.8)
- CVE-2023-37927: Vulnerability in Zyxel NAS units’ CGI program, enabling authenticated attackers to execute OS instructions with a crafted URL. (high-severity rating of 8.8)
- CVE-2023-37928: Submit-authentication command injection in Zyxel NAS units’ WSGI server, permitting authenticated attackers to execute OS instructions by way of a crafted URL. (high-severity rating of 8.8)
- CVE-2023-4473: Command injection flaw within the internet server of Zyxel NAS units, allowing unauthenticated attackers to execute OS instructions via a crafted URL. (critical-severity rating of 9.8)
- CVE-2023-4474: Vulnerability within the WSGI server of Zyxel NAS units, permitting unauthenticated attackers to execute OS instructions with a crafted URL. (critical-severity rating of 9.8)
Menace actors might exploit the vulnerabilities above to achieve unauthorized entry, execute some working system instructions, receive delicate system data, or to take full management of the affected Zyxel NAS units.
To deal with these dangers, customers of NAS326 are beneficial to improve to model V5.21(AAZF.15)C0 or later. Customers of NAS542 ought to improve their firmware to V5.21(ABAG.12)C0 or later, which repair the above flaws.
The vendor has offered no mitigation recommendation or workarounds, a firmware replace being the beneficial motion.
