NAS542 firmware vulnerabilities | LiveThreat CVE Feed

Product

NAS542 firmware

by Zyxel · last CVE Sep 10, 2024

On CISA KEVExploited in the wild

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities18 In the news0 Timeline

Severity mix

Critical 9High 7Medium 2Low 0

Severity

All severities18 Critical9 High7 Medium2 Low0

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add NAS542 firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-27992 In wildKEV	9.8	82%	Jun 19	Zyxel Multiple NAS Devices Command Injection Vulnerability Affected: < V5.21(ABAG.11)C0
CVE-2020-9054 In wildKEV	9.8	100%	Mar 4	ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi Affected: before 5.21\(abag.7\)c0
CVE-2024-6342	9.8	2%	Sep 10	UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions… Affected: <= V5.21(ABAG.15)C0
CVE-2024-29974	9.8	23%	Jun 4	UNSUPPORTED WHEN ASSIGNED The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(abag.14\)c0
CVE-2024-29973	9.8	86%	Jun 4	UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware… Affected: before 5.21\(abag.14\)c0
CVE-2024-29972	9.8	90%	Jun 4	UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(abag.14\)c0
CVE-2023-4474	9.8	30%	Nov 30	The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow… Affected: through 5.21\(abag.11\)c0
CVE-2023-4473	9.8	41%	Nov 30	A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an… Affected: through 5.21\(abag.11\)c0
CVE-2023-35138	9.8	40%	Nov 30	A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0… Affected: through 5.21\(abag.11\)c0
CVE-2023-37928	8.8	60%	Nov 30	A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could… Affected: through 5.21\(abag.11\)c0
CVE-2023-37927	8.8	2%	Nov 30	The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow… Affected: through 5.21\(abag.11\)c0
CVE-2020-13365	8.8	1%	Aug 6	Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used for a TELNET session… Affected: before v5.21\(abag.6\)c0
CVE-2020-13364	8.8	1%	Aug 6	A backdoor in certain Zyxel products allows remote TELNET access via a CGI script Affected: before v5.21\(abag.6\)c0
CVE-2023-35137	7.5	1%	Nov 30	An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could… Affected: through 5.21\(abag.11\)c0
CVE-2023-5372	7.2	28%	Jan 30	The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could… Affected: before 5.21\(abag.13\)c0
CVE-2023-27988	7.2	1%	May 30	The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator… Affected: before 5.21\(abag.10\)c0
CVE-2024-29975	6.7	0%	Jun 4	UNSUPPORTED WHEN ASSIGNED The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542… Affected: before 5.21\(abag.14\)c0
CVE-2024-29976	6.5	9%	Jun 4	UNSUPPORTED WHEN ASSIGNED The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and… Affected: before 5.21\(abag.14\)c0