CVE-2023-4473

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Nov 30, 2023 / Updated: 11mo ago

010
CVSS 9.8EPSS 0.1%Critical
CVE info copied to clipboard

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2023-4473

Nov 29, 2023 at 6:15 PM
First Article

Feedly found the first article mentioning CVE-2023-4473. See article

Nov 30, 2023 at 2:23 AM / CVE
EPSS

EPSS Score was set to: 0.1% (Percentile: 40.6%)

Dec 1, 2023 at 3:32 PM
Trending

This CVE started to trend in security discussions

Dec 1, 2023 at 10:06 PM
Threat Intelligence Report

The vulnerability CVE-2023-4473 is an authentication bypass vulnerability in Zyxel devices. It has a criticality level, but no CVSS score is provided. There is no information on whether it is being exploited in the wild or if there are any proof-of-concept exploits available. It is recommended to check for any available mitigations, detections, or patches from Zyxel, and there is no mention of downstream impacts to other vendors or technology. See article

Dec 6, 2023 at 1:53 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (731667)

Jul 22, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Zyxel/nas326_firmware
+null more

Patches

www.zyxel.com
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Zyxel security advisory for authentication bypass and command injection vulnerabilities in NAS products
CVE-2023-37928 A post-authentication command injection vulnerability in the WSGI server in Zyxel NAS devices could allow an authenticated attacker to execute some OS commands by sending a crafted URL to a vulnerable device. CVE-2023-4474 The improper neutralization of special elements in the WSGI server in Zyxel NAS devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted URL to a vulnerable device.
Post-auth blind Python code injection vulnerabilities in Zyxel’s NAS326 and NAS542 devices
Post-auth blind Python code injection vulnerabilities exist when some Zyxel NAS versions improperly handle user provided input. The web management interface appears to be vulnerable to Python code injection attacks.
Authentication bypass and multiple blind OS command injection vulnerabilities in Zyxel’s NAS326 devices
For example, chaining this authentication bypass vulnerability with the package initialization mechanism's post-auth OS command injection vulnerability allows an unauthenticated, remote attacker to execute arbitrary commands on the affected device. The web management interface appears to be vulnerable to OS command injection because an attacker can use the semicolon "" character to append arbitrary commands to the intended command string executed by the application.
See 4 more references

News

VulnCheck Initial Access Intelligence Update - July 2024
VulnCheck Initial Access Intelligence equips organizations and security teams with detection artifacts such as Suricata signatures, YARA rules, PCAPs, and private exploit PoCs to defend against initial access vulnerabilities that are either already being exploited or likely to be exploited soon. In July 2024, VulnCheck crossed 250+ Initial Access Intelligence (IAI) artifacts, developing artifacts for 14 CVEs, covering 13 different vendors and 10 different products.
4n6 Week 18 – 2024 - THREAT INTELLIGENCE/HUNTING
While monitoring attacks targeting MS-SQL servers, AhnLab SEcurity intelligence Center (ASEC) recently identified cases of the TargetCompany ransomware group installing the Mallox ransomware . Cookies and other credentials remain a high value target for attackers, and we are trying to tackle this ongoing threat in multiple ways, including working on web standards like DBSC that will help disrupt the cookie theft industry since exfiltrating these cookies will no longer have any value .
IT Security News Weekly Summary – Week 18
IT Security News Daily Summary 2024-05-05 USENIX Security ’23 – A Bug’s Life: Analyzing the Lifecycle and Mitigation Process of Content Security Policy Bugs – Distinguished Paper Award Winner Don’t Overlook the Cyber Risks for Operational Technology Lineaje Tackles Open-Source Management with New Solution The Quantum Security Challenge: Data Resilience Around the Unknown AI Could Transform Detection and Response as Legacy MDRs Lack Report: Spanish Authorities Discover CPF Nomination Note on iPad of Slain Singaporean Woman in Spain Hackers are Targeting Routers Across the Globe NATO and the EU formally condemned Russia-linked APT28 cyber espionage Offensive Awakening: The 2024 Shift from Defensive to Proactive Security End-to-end encryption may be the bane of cops, but they can’t close that Pandora’s Box Security Affairs newsletter Round 470 by Pierluigi Paganini – INTERNATIONAL EDITION Navigating the Digital Age: AI’s Crucial Role in Cybersecurity Reinforcement CISA Ask Companies to Fix Path Traversal Vulnerabilities NSW Cybercrime Squad Arrests Suspect in Million-Person Data Breach Case GenAI Continues to Dominate CIO and CISO Conversations RSAC 2024 Innovation Sandbox Reality Defender: Deepfake Detection Platform Insect Farmers Embrace AI to Drive Down Production Costs Week in review: PoCs allow persistence on Palo Alto firewalls, Okta credential stuffing attacks nslookup’s Debug Options, (Sun, May 5th) USENIX Security ’23 – Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs IT Security News Daily Summary 2024-05-04 Pay up, or else?
Your weekly roundup of Digital Forensics and Incident Response news
Google Cloud Threat Intelligence THREAT INTELLIGENCE/HUNTING
SANS NewsBites Vol. 26 Num. 35 : Verizon Breach Report; UnitedHealth Attempts to Silence Victims With ID Theft Monitoring; Increasing GPT Attacks
- www.securityweek.com : Verizon DBIR 2024 Shows Surge in Vulnerability Exploitation, Confirmed Data Breaches For me, a few key takeaways: 1) the human is still the weak link to building an effective cybersecurity program – exploitation of authentication credentials; 2) Ransomware had a very good year in 2023 – increase in both attacks and payouts; and 3) software supply chain attacks also had a good year and has become a major concern for security professionals.
See 81 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI