CVE-2019-10631 Command injection in n/a

What is CVE-2019-10631?

CVE-2019-10631 is a high-severity command injection vulnerability in n/a, published on 9 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.

Weakness: CWE-78

Which versions are affected by CVE-2019-10631?

It affects 1 product.

Products include Zyxel Nas326 Firmware.

How do I fix CVE-2019-10631?

No fix has been published for CVE-2019-10631 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-10631 being exploited?

There is no known exploitation of CVE-2019-10631 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-27992 Zyxel Multiple NAS Devices Command Injection Exploited Critical 9.8
• CVE-2024-6342 Command injection in NAS326 firmware Critical 9.8
• CVE-2024-29972 Command injection in NAS326 firmware Critical 9.8
• CVE-2024-29973 Command injection in NAS326 firmware Critical 9.8
• CVE-2024-29974 File upload in NAS326 firmware Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wx6c-ph9m-wxqg.