Administrator session hijacking via unrestricted show_allsessions callback

Improper privilege management in Zyxel NAS326 and NAS542 firmware allows remote authenticated users to steal administrator session tokens. The show_allsessions callback returns every authenticated user's authtok value and interface MAC addresses to any signed-in account without enforcing administrator authorization. A valid low-privileged account is required, and a disclosed administrator token grants administrator access to the device.