CVE-2023-27992

What it actually does

CVE-2023-27992 is a pre-authentication OS command injection vulnerability in Zyxel NAS326, NAS540, and NAS542 firmware. A remote attacker can send a crafted HTTP request to the NAS web interface that causes attacker-controlled input to be interpreted by the underlying operating system shell. Because exploitation requires no authentication, no user interaction, and is network reachable, successful exploitation can result in remote command execution with the privileges of the vulnerable NAS web service, potentially allowing file access, configuration changes, malware deployment, persistence, lateral movement, and service disruption.

Why it matters to the business

Compromise of an affected Zyxel NAS can expose or destroy stored business data, interrupt file-sharing and backup operations, and provide attackers with a foothold inside the network. The vulnerability is listed in CISA KEV, has been observed exploited in the wild, has a high EPSS likelihood, and had a CISA remediation deadline of 2023-07-14, so any internet-exposed or unpatched device should be treated as high priority and potentially already targeted.

How an attack unfolds

An attacker scans the internet or internal network for Zyxel NAS326, NAS540, or NAS542 devices exposing the management or web service. The attacker sends a specially crafted unauthenticated HTTP request containing shell metacharacters or command payloads to the vulnerable firmware component. The NAS fails to safely validate or escape the supplied input, causing part of the request to execute as an operating system command. Initial commands are often used to confirm execution, identify the device, download tooling, add users or keys, modify startup scripts, deploy botnet or cryptomining malware, stage data theft, or disable services. Because this issue is pre-authentication and known to be exploited in the wild, successful attacks may occur rapidly after exposure, especially against devices reachable from the internet.

How to fix it

Upgrade affected Zyxel NAS firmware to the vendor-fixed versions or later: NAS326 to V5.21(AAZF.14)C0 or later, NAS540 to V5.21(AATB.11)C0 or later, and NAS542 to V5.21(ABAG.11)C0 or later. If immediate upgrade is not possible, remove internet exposure, restrict access to the NAS web interface to trusted management networks or VPN only, block inbound access at firewalls, disable unnecessary services, and monitor for outbound connections from the NAS. Because the vulnerability is pre-authentication and exploited in the wild, mitigation by access control should be treated as temporary; firmware update or device retirement is the durable fix. After patching, rotate credentials and review stored data access if compromise is suspected.

How to confirm the fix worked

Confirm the installed firmware version directly from the Zyxel NAS administrative interface or device inventory and verify it is at or above the fixed release for the exact model. Validate that the NAS web interface is not reachable from the public internet unless explicitly required and protected by strong network controls. Run authenticated vulnerability scanning or configuration assessment where possible to confirm model and firmware version. Review firewall, reverse proxy, and NAS HTTP logs for crafted unauthenticated requests before the patch date and after remediation. Confirm that no unexpected users, SSH keys, startup entries, cron jobs, web files, or recently modified system scripts remain on the device.

Typical attack path

1. Identify Zyxel NAS326, NAS540, or NAS542 devices through internet scanning, banner collection, Shodan-style search, or internal reconnaissance.
2. Confirm the device exposes the vulnerable NAS web interface and appears to run a firmware version prior to the fixed release.
3. Send a crafted unauthenticated HTTP request containing command-injection syntax to the vulnerable endpoint.
4. Execute a simple validation command such as reading system information, writing a temporary file, or initiating an outbound callback.
5. Download and execute additional payloads using built-in tools such as wget, curl, tftp, ftp, busybox, or sh.
6. Establish persistence by modifying startup scripts, scheduled tasks, user accounts, SSH configuration, or web-accessible files.
7. Use the NAS to access stored files, exfiltrate data, pivot to other systems, join a botnet, or disrupt backup and file-sharing operations.

How to detect it

Review NAS web access logs, upstream firewall logs, VPN logs, reverse proxy logs, IDS/IPS alerts, DNS logs, and egress network telemetry for evidence of crafted unauthenticated HTTP requests followed by command execution or outbound downloads. Focus on requests to the Zyxel NAS web interface containing shell metacharacters such as semicolons, pipes, backticks, encoded newline characters, or command substitution, especially when combined with commands like wget, curl, tftp, ftpget, busybox, sh, chmod, nc, telnet, or base64. On the NAS, examine recent file modifications, startup scripts, cron entries, user accounts, SSH authorized_keys, temporary directories, and web-accessible directories for unfamiliar files. Look for outbound connections from the NAS to unfamiliar IPs shortly after suspicious HTTP requests, DNS lookups for newly observed domains, or downloads of ELF binaries typical of embedded Linux malware. Because exploitation is known in the wild, absence of authentication logs is not reassuring; correlate unauthenticated HTTP requests with process execution, filesystem changes, and outbound traffic.

• HTTP requests to Zyxel NAS web interface containing ";wget"
• HTTP requests to Zyxel NAS web interface containing ";curl"
• HTTP requests to Zyxel NAS web interface containing "|wget"
• HTTP requests to Zyxel NAS web interface containing "|curl"
• HTTP requests to Zyxel NAS web interface containing "`wget"
• HTTP requests to Zyxel NAS web interface containing "`curl"
• HTTP requests containing "$%28" or "$%7B" near command parameters
• HTTP requests containing URL-encoded semicolon "%3b" followed by "sh"
• HTTP requests containing URL-encoded pipe "%7c" followed by "sh"
• HTTP requests containing "busybox"
• HTTP requests containing "tftp"
• HTTP requests containing "ftpget"
• HTTP requests containing "chmod +x"
• HTTP requests containing "cd /tmp"
• HTTP requests containing "/bin/sh"
• HTTP requests containing "/bin/bash"
• HTTP requests containing "nc -e"
• HTTP requests containing "telnetd"
• HTTP requests containing "base64 -d"
• Unexpected executable files in "/tmp"
• Unexpected executable files in "/var/tmp"
• Unexpected executable files in "/dev/shm"
• Unexpected entries in "/etc/crontab"
• Unexpected files in "/etc/cron.d/"
• Unexpected SSH keys in "/root/.ssh/authorized_keys"
• Unexpected SSH keys in "/admin/.ssh/authorized_keys"
• Unexpected modifications to "/etc/passwd"
• Unexpected modifications to "/etc/shadow"
• Unexpected startup-script modifications under "/etc/init.d/"
• Outbound NAS connections followed by user agents containing "Wget"
• Outbound NAS connections followed by user agents containing "curl"

What your security team should do

• Immediately inventory Zyxel NAS326, NAS540, and NAS542 devices, prioritizing any internet-facing systems.
• Upgrade NAS326 to V5.21(AAZF.14)C0 or later, NAS540 to V5.21(AATB.11)C0 or later, and NAS542 to V5.21(ABAG.11)C0 or later.
• Treat unpatched internet-exposed devices as potentially compromised due to KEV status, active exploitation, and high EPSS probability.
• Temporarily block public access to NAS management and web services until firmware is verified fixed.
• Hunt historical logs for unauthenticated HTTP requests containing command-injection metacharacters, download commands, outbound callbacks, or suspicious process launches.
• Inspect devices for persistence, unexpected accounts, modified startup scripts, web shells, malware binaries, and unusual outbound network connections.
• Rotate NAS administrative credentials and any credentials stored on or used by the NAS if compromise cannot be ruled out.
• Verify backups are intact, offline or immutable where possible, and not solely dependent on the affected NAS platform.
• Retire or isolate devices that cannot be upgraded to fixed firmware.