CVE-2022-34747

—

CVSS 3.1

9.8 critical

EPSS

2%p76

Published

Sep 6, 2022 (Sep 6, 2022)

Modified

Jun 17, 2026

Description

A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.

Vendors: zyxel
Products: nas326 firmware
Weakness: CWE-134
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news2 stories

Critical RCE Vulnerability Affects Zyxel NAS Devices — Firmware Patch Released

The Hacker NewsSep 8, 03:14 UTC · Sep 8, 2022Vulnerability CVE-2022-34747 CVE-2022-30526 CVE-2022-2030+1 CVEs

Zyxel addressed a critical RCE flaw in its NAS devices

Security AffairsSep 7, 08:53 UTC · Sep 7, 2022Vulnerability CVE-2022-34747 CVE-2022-26532 CVE-2022-0734+2 CVEs