CVE-2023-27992
Zyxel Multiple NAS Devices Command Injection Vulnerability
Description
CVE-2023-27992 is a critical pre-authentication command injection vulnerability in Zyxel NAS devices, including the NAS326, NAS540, and NAS542 models. The flaw allows an unauthenticated remote attacker to execute arbitrary operating system commands by sending a specially crafted HTTP request to the device's web interface. With a CVSS score of 9.8 (Critical) and an EPSS score of 86.5% (99th percentile), CVE-2023-27992 represents one of the most likely-to-be-exploited vulnerabilities in the landscape. CISA has added this command injection vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild against Zyxel NAS products.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | nas326 firmware | < 5.21\(aazf.14\)c0 |
| zyxel | nas540 firmware | < 5.21\(aatb.11\)c0 |
| zyxel | nas542 firmware | < 5.21\(abag.11\)c0 |
References
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where user-controllable input is incorporated into operating system commands without proper sanitization, allowing an attacker to inject and execute arbitrary OS commands. In CVE-2023-27992, the Zyxel NAS firmware fails to properly neutralize special elements in HTTP request parameters before passing them to system-level command execution routines, enabling unauthenticated attackers to run commands with the privileges of the web server process.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2023-27992 is rated Critical with a CVSS score of 9.8 under CVSS v3.1, the highest practical severity for a vulnerability with unchanged scope. The vulnerability is remotely exploitable over the network without any special conditions, making it accessible to any attacker who can reach the device's HTTP interface. Attack Complexity (Low) means the exploit works reliably without race conditions or special configurations. No authentication is required and no user interaction is needed, meaning the attack can be fully automated against exposed Zyxel NAS devices. Successful exploitation delivers high impact across all three security dimensions: Confidentiality (High) allows the attacker to access all stored data on the NAS, Integrity (High) enables modification or deletion of files and firmware, and Availability (High) means the device can be rendered inoperable or used as a staging point for further attacks. The EPSS score of 86.5% places this vulnerability in the 99th percentile, indicating near-certain exploitation activity across the internet.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-27992 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of July 14, 2023. The EPSS score of 86.5% places this vulnerability in the 99th percentile, indicating an extremely high probability of exploitation activity and suggesting widespread automated scanning and exploitation attempts against exposed Zyxel NAS devices. The combination of unauthenticated remote code execution, a network-accessible attack vector, and the prevalence of NAS devices exposed to the internet makes this vulnerability highly attractive to threat actors. No public proof-of-concept exploit is referenced in the available advisories, but the exceptionally high EPSS score and KEV inclusion strongly indicate that working exploits are circulating in the wild.
Remediation
- Update Zyxel NAS firmware immediately to the patched versions: NAS326 firmware V5.21(AAZF.14)C0 or later, NAS540 firmware V5.21(AATB.11)C0 or later, and NAS542 firmware V5.21(ABAG.11)C0 or later, as documented in Zyxel's security advisory.
- Remove NAS devices from direct internet exposure by placing them behind a firewall or VPN. Zyxel NAS web interfaces should never be directly accessible from the public internet, as this vulnerability requires only HTTP access to exploit.
- Implement network-level access controls to restrict HTTP/HTTPS access to the NAS management interface to trusted IP addresses or management VLANs only. Configure firewall rules to block all inbound connections to the NAS web interface from untrusted networks.
- Monitor NAS device logs for indicators of compromise, including unexpected command execution, unauthorized file access patterns, new user account creation, or anomalous network connections originating from the NAS device that could indicate post-exploitation activity such as reverse shells or data exfiltration.
- Audit all stored data on potentially compromised devices, as the command injection vulnerability grants OS-level access. If exploitation is suspected, perform a full forensic analysis, reset the device to factory settings, apply the patched firmware, and restore data from verified clean backups.
Technical Details
CVE-2023-27992 is an OS command injection vulnerability (CWE-78) in the web management interface of Zyxel NAS326, NAS540, and NAS542 network-attached storage devices. The vulnerability exists in the pre-authentication request handling path, meaning the attacker does not need to log in before sending the malicious payload. When the NAS firmware processes certain HTTP request parameters, it incorporates user-supplied input into operating system commands without adequate sanitization of special characters such as semicolons, pipes, or backticks, enabling the attacker to inject and execute arbitrary commands. Attack Vector (Network) confirms the vulnerability is exploitable remotely via HTTP, Attack Complexity (Low) indicates no timing dependencies or special configurations are required, and Privileges Required (None) combined with User Interaction (None) establishes that the attack is fully unauthenticated and automated. The injected commands execute with the privileges of the web server process, which on embedded NAS devices typically runs as root, granting the attacker complete control over the device, its stored data, and its network connectivity.
Frequently Asked Questions
Is CVE-2023-27992 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2023-27992 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 14, 2023. The EPSS score of 86.5% (99th percentile) indicates an extremely high probability of exploitation, consistent with widespread scanning and attack activity targeting exposed Zyxel NAS devices.
What products are affected by CVE-2023-27992?
CVE-2023-27992 affects three Zyxel NAS models: the NAS326 (firmware versions prior to V5.21(AAZF.14)C0), the NAS540 (firmware versions prior to V5.21(AATB.11)C0), and the NAS542 (firmware versions prior to V5.21(ABAG.11)C0). All three devices are vulnerable through their web management interface.
How do I fix CVE-2023-27992?
Update the Zyxel NAS firmware to the patched versions: NAS326 to V5.21(AAZF.14)C0, NAS540 to V5.21(AATB.11)C0, and NAS542 to V5.21(ABAG.11)C0 or later. As an immediate mitigation, remove the NAS web interface from internet exposure and restrict access to trusted networks only.
How severe is CVE-2023-27992?
CVE-2023-27992 is rated Critical with a CVSS score of 9.8 out of 10, the highest practical severity rating. The vulnerability enables unauthenticated remote command execution with no user interaction required, and its 99th percentile EPSS score confirms it is among the most actively targeted vulnerabilities in the current threat landscape.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.