Command Injection Vulnerability Found in Zyxel NAS Devices (CVE-2023-27988)

Hi everyone, Recently researchers discovered a command injection vulnerability (CVE-2023-27988) in Linux-operated Zyxel NAS devices.

This issue allowed authenticated users to execute arbitrary system commands with root privileges, having a vulnerability like this could lead to a ton of unexpected attacks and modifications of the system.

Zyxel was alerted and issued a security patch on May 30, 2023. Kudos to Zyxel for their prompt response instead of ignoring the alerts and not taking any action.

Thought I’d make this post …

attacks command command injection cve cybersecurity devices injection issue linux nas privileges researchers root system ton vulnerability zyxel