CVE-2020-9054 is a critical pre-authentication command injection vulnerability affecting multiple ZyXEL Network-Attached Storage (NAS) devices running firmware version 5.21 and earlier. This flaw allows a remote, unauthenticated attacker to execute arbitrary code with root privileges by manipulating the username parameter in weblogin.cgi. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. Successful exploitation can lead to full device control, even through indirect means like visiting a malicious website. This vulnerability is actively exploited in the wild, as confirmed by its presence in the CISA KEV catalog and its high EPSS score. While no Metasploit or ExploitDB modules are publicly available, Nuclei templates exist, and it has garnered significant community discussion and media coverage, including its use in Mirai and BotenaGo botnet strains.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.21\(aazf.7\)c0CPE matchmatch criteria | cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:* | ||
< 5.21\(aasz.3\)c0CPE matchmatch criteria | cpe:2.3:o:zyxel:nas520_firmware:*:*:*:*:*:*:*:* | ||
< 5.21\(aatb.4\)c0CPE matchmatch criteria | cpe:2.3:o:zyxel:nas540_firmware:*:*:*:*:*:*:*:* | ||
< 5.21\(abag.4\)c0CPE matchmatch criteria | cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:* | ||
>= 4.35, < 4.35\(abps.3\)c0CPE matchmatch criteria | cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.