NAS542 firmware vulnerabilities

14 known vulnerabilities in NAS542 firmware from Zyxel. 14 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-6342Sep 10, 2024ZyxelEPSS 2.06%

  **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some o

• 9.8 Critical severity

  NAS326 firmware: Unrestricted Upload of File with Dangerous Type

  CVE-2024-29974Jun 4, 2024ZyxelEPSS 22.8%

  ** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker

• 9.8 Critical severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-29973Jun 4, 2024ZyxelEPSS 86.2%

  ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute s

• 9.8 Critical severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-29972Jun 4, 2024ZyxelEPSS 90.3%

  ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to e

• 7.2 High severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-5372Jan 30, 2024ZyxelEPSS 28.5%

  The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operati

• 9.8 Critical severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-4474Nov 30, 2023ZyxelEPSS 29.7%

  The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by send

• 9.8 Critical severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-4473Nov 30, 2023ZyxelEPSS 41.3%

  A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted U

• 8.8 High severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-37928Nov 30, 2023ZyxelEPSS 60.2%

  A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by

• 8.8 High severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-37927Nov 30, 2023ZyxelEPSS 1.75%

  The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sendin

• 9.8 Critical severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-35138Nov 30, 2023ZyxelEPSS 40%

  A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) com

• 7.5 High severity

  NAS326 firmware: Improper Authentication

  CVE-2023-35137Nov 30, 2023Zyxel

  An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted U

• 9.8 Critical severity

  Zyxel Multiple NAS Devices Command Injection Exploited

  CVE-2023-27992Jun 19, 2023ZyxelEPSS 82.3%

  The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated at

• 7.2 High severity

  NAS326 firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-27988May 30, 2023ZyxelEPSS 1.36%

  The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device rem

• 9.8 Critical severity

  Zyxel Multiple NAS Devices OS Command Injection Exploited

  CVE-2020-9054Mar 4, 2020ZyxelEPSS 100%

  Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS dev