Known vulnerabilities in NAS326

Vendor: ZyXEL Communications Corp.
Software: NAS326
Software CPE: cpe:2.3:h:zyxel_communications_corp:nas326:*:*:*:*:*:*:*:*
Website: https://www.zyxel.com/
Total vulnerabilities: 15
Public exploits: 5
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting NAS326 NAS326 is affected by 15 known vulnerabilities: 8 high, 4 medium, 3 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU91250 - Improper Privilege Management
CVE-2024-29976		 CWE-269 Medium
Available
No
 5.21(AAZF.17)C0 06.06.2024 SB2024060611
#VU91249 - Improper Privilege Management
CVE-2024-29975		 CWE-269 Low
Available
No
 5.21(AAZF.17)C0 06.06.2024 SB2024060611
#VU91248 - Unrestricted Upload of File with Dangerous Type
CVE-2024-29974		 CWE-434 High
Available
No
 5.21(AAZF.17)C0 06.06.2024 SB2024060611
#VU91247 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-29973		 CWE-78 High
Available
No
 5.21(AAZF.17)C0 06.06.2024 SB2024060611
#VU91246 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-29972		 CWE-78 High
Available
No
 5.21(AAZF.17)C0 06.06.2024 SB2024060611
#VU85883 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-5372		 CWE-78 Low
No
No
 5.21(AAZF.16)C0 30.01.2024 SB2024013004
#VU83600 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2023-4474		 CWE-74 High
No
No
 5.21(AAZF.15)C0 30.11.2023 SB2023113040
#VU83599 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-4473		 CWE-78 High
No
No
 5.21(AAZF.15)C0 30.11.2023 SB2023113040
#VU83598 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-37928		 CWE-78 Medium
No
No
 5.21(AAZF.15)C0 30.11.2023 SB2023113040
#VU83597 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2023-37927		 CWE-74 Medium
No
No
 5.21(AAZF.15)C0 30.11.2023 SB2023113040
#VU83596 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-35138		 CWE-78 High
No
No
 5.21(AAZF.15)C0 30.11.2023 SB2023113040
#VU83594 - Improper Authentication
CVE-2023-35137		 CWE-287 Medium
No
No
 5.21(AAZF.15)C0 30.11.2023 SB2023113040
#VU77532 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-27992		 CWE-78 High
No
Exploited
 5.21(AAZF.14)C0 20.06.2023 SB2023062001
#VU76619 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-27988		 CWE-78 Low
No
No
 5.21(AAZF.13)C0 30.05.2023 SB2023053017
#VU67062 - Use of Externally-Controlled Format String
CVE-2022-34747		 CWE-134 High
No
No
 5.21(AAZF.12)C0 07.09.2022 SB2022090724