January 13, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Advisory – Multiple IBM Db2 Vulnerabilities
December 4, 2023
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
December 4, 2023
Rewterz Threat Advisory – Multiple IBM Db2 Vulnerabilities
December 4, 2023
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
December 4, 2023
Severity
High
Analysis Summary
CVE-2023-37928 CVSS:8.8
Zyxel NAS326 and NAS542 devices could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper neutralization of user-supplied input by the WSGI server. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVE-2023-37927 CVSS:8.8
Zyxel NAS326 and NAS542 devices could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper neutralization of user-supplied input by the CGI program. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVE-2023-35138 CVSS:9.8
Zyxel NAS326 and NAS542 devices could allow a remote attacker to execute arbitrary commands on the system, caused by a command injection vulnerability in the show_zysync_server_contents function. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVE-2023-35157 CVSS:7.5
Zyxel NAS326 and NAS542 devices could allow a remote attacker to obtain sensitive information, caused by improper authentication in the authentication module. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVE-2023-4473 CVSS:9.8
Zyxel NAS326 and NAS542 devices could allow a remote attacker to execute arbitrary commands on the system, caused by a command injection vulnerability in the web server. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
Impact
- Gain Access
- Information Disclosure
Indicators Of Compromise
CVE
- CVE-2023-37928
- CVE-2023-37927
- CVE-2023-35138
- CVE-2023-35157
- CVE-2023-4473
Affected Vendors
Zyxel
Affected Products
- Zyxel NAS326 5.21(AAZF.14)C0
- Zyxel NAS542 5.21(ABAG.11)C0
Remediation
Refer to Zyxel Website for patch, upgrade or suggested workaround information.