Zyxel Releases Security Update for Unauthorized Remote Code Execution Vulnerability

Zyxel releases security update for a Critical vulnerability affecting multiple NAS products

Threat ID:: CC-4159
Threat Severity:: Information only
Published:: 7 September 2022 1:59 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Zyxel releases security update for a Critical vulnerability affecting multiple NAS products

Affected platforms

The following platforms are known to be affected:

Versions: V5.21(AAZF.11)C0 and earlier

Zyxel NAS326

Versions: V5.21(AATB.8)C0 and earlier

Zyxel NAS540

Versions: V5.21(ABAG.8)C0 and earlier

Zyxel NAS542

Threat details

Introduction

Zyxel has released a security update for a Critical vulnerability, tracked as CVE-2022-34747. The vulnerability could allow a remote unauthenticated attacker to achieve remote code execution via a crafted UDP (User Datagram Protocol) packet in a number of NAS products.

Remediation advice

Affected organisations are encouraged to review Zyxel's security advisory and apply relevant updates and mitigations.

Definitive source of threat updates

https://www.zyxel.com/support/Zyxel-security-advisory-for-format-string-vulnerability-in-NAS.shtml

CVE Vulnerabilities

Status Published

CVE-2022-34747

A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.

Last edited: 7 September 2022 2:16 pm