Zyxel releases new NAS firmware to fix critical RCE vulnerability

guest · Sep 7, 2022

By Bill Toulas @billtoulas - September 6, 2022

Networking device maker Zyxel is warning customers today of a new critical remote code execution (RCE) vulnerability impacting three models of its Networked Attached Storage (NAS) products.

The vulnerability is tracked as CVE-2022-34747 and has received a CVSS v3 severity score of 9.8, rated critical, but not many details have been disclosed.

“A format string vulnerability was found in a specific binary of Zyxel NAS products that could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet,” explains the advisory.
Click to expand...

Security researcher Shaposhnikov Ilya discovered the vulnerability on June 2022. As a result, Zyxel gradually released security updates for the impacted models over the following months.

The NAS devices vulnerable to this flaw are NAS326, NAS540, and NAS542, all still within their active support period.
The vulnerable firmware versions are V5.21(AAZF.11)C0 and earlier for NAS326, V5.21(AATB.8)C0 and earlier for NAS540, and V5.21(AATB.8)C0 or older for NAS542.
Click to expand...

Alternatively, you can visit Zyxel’s official download portal, enter your device model, and download the latest firmware update listed in the results.
Click to expand...

Log in or Sign up

Zyxel releases new NAS firmware to fix critical RCE vulnerability

guest Guest

Log in or Sign up

Zyxel releases new NAS firmware to fix critical RCE vulnerability

guest Guest

Useful Searches