The networking device manufacturer Zyxel has released a security advisory urging customers to patch a critical zero-day vulnerability present in three (3) models of its Networked Attached Storage (NAS) devices. The flaw, tracked as CVE-2022-34747, is the result of an externally controlled format string vulnerability within a Zyxel NAS device binary. The vulnerable software utilizes a function which accepts a format string as an argument, however the issue is that the format string can originate from a source external to the target network. If exploited, attackers could send a maliciously crafted UDP packet to a vulnerable device, allowing them to perform unauthorized remote code execution (RCE). This flaw poses a considerable risk to public-facing devices and their networks, receiving a CVSS score of 9.8/10 due to the low-complexity of the attack as well as the attacker being able to bypass authentication. Once exploited, attackers could elevate their privileges, giving them full reign to move laterally across the network, steal sensitive data, delete databases, encrypt them with ransomware, or download other types of malware. The affected Zyxel NAS devices are models NAS326, NAS540, and NAS542 running firmware versions prior to V5.21(AAZF.11), V5.21(AATB.8), and V5.21(AATB.8). Zyxel recommends that all customers deploying affected NAS devices ensure that they are running the newest version of the firmware. RCE attacks against NAS devices are becoming increasingly common. Just days before this flaw was disclosed, another NAS device manufacturer called QNAP patched critical vulnerabilities that were being actively exploited to deploy DeadBolt ransomware on their own NAS products. As a best practice, CTIX analysts recommend that administrators block their NAS devices from the public facing internet unless absolutely necessary, create strong passwords for all user accounts, and maintain regular device backups.