Multiple Critical Flaws Found In Zyxel NAS Devices

Zyxel NAS users must rush to update their devices at the earliest as the vendors have patched numerous security flaws. Exploiting these vulnerabilities could allow severe threats from unauthorized users.

Zyxel NAS Devices Exhibited Numerous Security Flaws

According to a recent advisory, Zyxel disclosed patching multiple security flaws affecting its NAS devices. Specifically, the vendor addressed six different vulnerabilities, including three critical-severity issues that could risk the devices’ security. These include,

• CVE-2023-35137: An improper authentication vulnerability in the authentication module allowed an unauthenticated adversary to access system information. Exploiting the flaw required the attacker to send a maliciously crafted URL to the target device.
• CVE-2023-35138: A command injection vulnerability in the show_zysync_server_contents function. An unauthenticated adversary could execute operating system (OS) commands on the target device by sending a maliciously crafted HTTP POST request.
• CVE-2023-37927: This vulnerability could allow OS command execution to an authenticated attacker. The flaw existed due to improper neutralization of special elements in the CGI program in NAS devices.
• CVE-2023-37928: A command injection vulnerability in the WSGI server allowing OS command execution attacks from an authenticated adversary.
• CVE-2023-4473: A command injection vulnerability in the Zyxel NAS web server allowing OS command execution from an unauthenticated attacker.
• CVE-2023-4474: The improper neutralization of special elements in the Zyxel NAS WSGI server could allow OS command execution from an unauthenticated attacker.

Zyxel acknowledged the researchers Maxim Suslov, Gábor Selján from BugProve, and Drew Balfour from IBM X-Force for separately discovering and reporting these vulnerabilities.

Regarding the vulnerable devices, these vulnerabilities affected the Zyxel NAS326 V5.21(AAZF.14)C0 and earlier, and NAS542 V5.21(ABAG.11)C0 and earlier. Following the bug reports, the vendor patched the vulnerabilities with Zyxel NAS326 V5.21(AAZF.15)C0 and NAS542 V5.21(ABAG.12)C0. Hence, to avoid potential risks, users must update their vulnerable NAS devices to the latest firmware releases to receive the patches.

Let us know your thoughts in the comments.