CVE-2023-27988 Command injection in NAS326 firmware

High 7.2 Published 30 May 2023 Updated 14 Jan 2025

Authenticated administrators can remotely execute OS commands on Zyxel NAS devices due to improper input handling.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-27988?

CVE-2023-27988 is a high-severity command injection vulnerability in Zyxel NAS326 firmware, published on 30 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.

Weakness: CWE-78

Which versions are affected by CVE-2023-27988?

It affects 3 products.

Products include Zyxel Nas326 Firmware, Zyxel Nas540 Firmware, Zyxel Nas542 Firmware.

How do I fix CVE-2023-27988?

No fix has been published for CVE-2023-27988 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-27988 being exploited?

There is no known exploitation of CVE-2023-27988 in the wild and no public exploit code.

Sources

Also known as GHSA-wc8j-6g5m-3r95.