pentester.land· Nov 30, 2023· by Gábor Selján (@GaborSeljan)🔍 CVE-2023-4473

CVE-2023-4473 & CVE-2023-4474 - Authentication bypass and multiple blind OS command injection vulnerabilities in Zyxel’s NAS326 devices

Target Program: Zyxel

🎯 Vulnerability: Remote Code Execution (RCE)

💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.

#Authentication bypass#OS command injection#RCE#Security code review#CVE-2023-4473#CVE-2023-4474