** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel…
Zyxel · NAS326 firmware
The command injection flaw lives in the "remote_help-cgi" CGI program of Zyxel NAS326 firmware (before V5.21(AAZF.17)C0) and NAS542 firmware (before V5.21(ABAG.14)C0). An unauthenticated attacker with network access to the device can execute some operating system commands by sending a crafted HTTP POST request, with no user interaction required.
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 12 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 16 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+16 days
- First seen exploitedVulnCheck KEV evidence+12 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.