Security Advisory For Vulnerability In NAS Appliances

Zyxel has released patches addressing a post-authentication command injection vulnerability in some NAS versions.

Users are advised to install them for optimal protection.

What is the vulnerability?

The post-authentication command injection vulnerability has been found in the web management interface of some NAS versions.

An authenticated attacker with administrator privileges could leverage this vulnerability to execute some operating system (OS) commands on an affected device remotely.

What versions are vulnerable—and what should you do?

After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period, with their firmware patches shown in the table below.