CVE-2023-27992 Zyxel Multiple NAS Devices Command Injection

Exploited in the wild Critical 9.8 Published 19 Jun 2023 Updated 21 Oct 2025

Unauthenticated attackers can execute arbitrary OS commands on Zyxel NAS devices via crafted HTTP requests, requiring firmware upgrades.

Exploited in the wild: Since 23 Jun 2023
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-27992?

CVE-2023-27992 is a critical command injection vulnerability in Zyxel NAS326 firmware, published on 19 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

Weakness: CWE-78

Which versions are affected by CVE-2023-27992?

It affects 3 products.

Products include Zyxel Nas326 Firmware, Zyxel Nas540 Firmware, Zyxel Nas542 Firmware.

How do I fix CVE-2023-27992?

No fix has been published for CVE-2023-27992 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Jul 2023.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-27992 being exploited?

Yes. Attackers have exploited CVE-2023-27992 in the wild since at least 23 Jun 2023.

Sources

Also known as GHSA-5wv9-h9hr-4p52.