Zyxel Releases Security Update
Update addresses a Critical vulnerability in several Network Attached Storage (NAS) devices
Summary
Update addresses a Critical vulnerability in several Network Attached Storage (NAS) devices
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Zyxel has released a security update to address a Critical vulnerability in NAS326, NAS540, and NAS542 network adjacent storage devices. The vulnerability known as CVE-2023-27992 has a CVSSv3 score of 9.8 and relates to a pre-authentication command injection vulnerability. A remote, unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP request, which could allow them to execute operating system (OS) commands.
Exploitation in the wild for CVE-2023-27992
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-27992 to their Known Exploited Vulnerability Catalog based on evidence of active exploitation in the wild.
Threat updates
| Date | Update |
|---|---|
| 26 Jun 2023 |
Exploitation in the wild for CVE-2023-27992
This cyber alert has been updated to reflect this change. |
Remediation advice
Affected organisations are encouraged to review Zyxel's security advisory and apply relevant updates and mitigations.
Definitive source of threat updates
Last edited: 26 June 2023 1:10 pm