CVE-2023-27992

Zyxel NAS devices vulnerable to remote command injection.

Zyxel's multiple network-attached storage (NAS) devices are vulnerable to a pre-authentication command injection vulnerability, allowing remote command execution via crafted HTTP requests. This poses a significant risk to organizations using these devices, as it can be exploited without authentication. Immediate patching is recommended to mitigate this high-risk vulnerability.

Shame score — Zyxel's history of releasing products with critical vulnerabilities, coupled with the high severity of the command injection flaw, indicates a significant lapse in security posture and risk management.