https://bit.ly/4a2jHiK - 🌍 Zyxel has issued a security advisory for multiple vulnerabilities in their NAS products, specifically addressing an authentication bypass and several command injection issues. The vulnerabilities, identified by CVE numbers CVE-2023-35137, CVE-2023-35138, CVE-2023-37927, CVE-2023-37928, CVE-2023-4473, and CVE-2023-4474, pose significant risks to system security. Users are strongly advised to update their devices with the latest patches provided by Zyxel for enhanced protection. #CyberSecurity #ZyxelNAS #VulnerabilityUpdate 🔒 The identified vulnerabilities vary in their nature and potential impact. They range from improper authentication in the authentication module (CVE-2023-35137) to several command injection vulnerabilities in different components of Zyxel NAS devices (CVE-2023-35138, CVE-2023-37927, CVE-2023-37928, CVE-2023-4473, CVE-2023-4474). These vulnerabilities could allow both unauthenticated and authenticated attackers to execute operating system commands, leading to possible unauthorized access and control. #NetworkSecurity #CommandInjection #AuthenticationBypass 🔎 Affected Zyxel NAS models include NAS326 and NAS542, with specific firmware versions listed as vulnerable. Users of these models should refer to the advisory for the appropriate firmware patches. Zyxel’s proactive approach in identifying and addressing these issues reflects their commitment to customer security and product integrity. #FirmwareUpdate #NASsecurity #ZyxelAdvisory 💡 The discovery of these vulnerabilities was made possible thanks to the efforts of security researchers Maxim Suslov, Attila Szász from BugProve, and Drew Balfour from IBM X-Force. Their contributions underscore the importance of collaborative security research in identifying and mitigating potential cyber threats. #CyberResearch #CollaborativeSecurity #ThreatIntelligence 📅 As of November 30, 2023, Zyxel has released the initial advisory with detailed information on the vulnerabilities and the available patches. Users are encouraged to contact their local service representatives or visit Zyxel’s Community for additional information and support in addressing these security concerns.
