CVE-2023-27992
ZY
Zyxel Multiple Network-Attached Storage (NAS) Devices
Zyxel Multiple NAS Devices Command Injection Vulnerability
What it is
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authen
- nvd.nist.gov/vuln/detail/CVE-2023-27992
Description and required action as published by CISA. Full record at NVD.
Other Zyxel entries on the list
- GS1900 Series Switches Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability CVE-2026-7273 · Sep 21, 2026
- DSL CPE Devices Zyxel DSL CPE OS Command Injection Vulnerability CVE-2024-40891 · Feb 11, 2025
- DSL CPE Devices Zyxel DSL CPE OS Command Injection Vulnerability CVE-2024-40890 · Feb 11, 2025
- Multiple Firewalls Zyxel Multiple Firewalls Path Traversal Vulnerability CVE-2024-11667 · Dec 3, 2024
- EMG2926 Routers Zyxel EMG2926 Routers Command Injection Vulnerability CVE-2017-6884 · Sep 18, 2023
- P660HN-T1A Routers Zyxel P660HN-T1A Routers Command Injection Vulnerability CVE-2017-18368 · Aug 7, 2023