CVE-2020-9054
Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Description
CVE-2020-9054 is a critical OS command injection vulnerability in Zyxel multiple NAS (Network Attached Storage) devices that allows unauthenticated remote attackers to execute arbitrary operating system commands via the weblogin.cgi component. The flaw stems from improper sanitization of user-supplied input in the username parameter during authentication, enabling pre-authentication remote code execution. CISA has added CVE-2020-9054 to the Known Exploited Vulnerabilities catalog, and this vulnerability is a confirmed ransomware attack vector. With an EPSS score of 94.3% (99.9th percentile), CVE-2020-9054 represents a severe threat to any organization running vulnerable Zyxel NAS devices exposed to the network.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | nas326 firmware | < 5.21\(aazf.7\)c0 |
| zyxel | nas520 firmware | < 5.21\(aasz.3\)c0 |
| zyxel | nas540 firmware | < 5.21\(aatb.4\)c0 |
| zyxel | nas542 firmware | < 5.21\(abag.4\)c0 |
| zyxel | atp100 firmware | >= 4.35, < 4.35\(abps.3\)c0 |
| zyxel | atp200 firmware | >= 4.35, < 4.35\(abfw.3\)c0 |
| zyxel | atp500 firmware | >= 4.35, < 4.35\(abfu.3\)c0 |
| zyxel | atp800 firmware | >= 4.35, < 4.35\(abiq.3\)c0 |
| zyxel | usg20-vpn firmware | >= 4.35, < 4.35\(abaq.3\)c0 |
| zyxel | usg20w-vpn firmware | >= 4.35, < 4.35\(abar.3\)c0 |
| zyxel | usg40 firmware | >= 4.35, < 4.35\(aala.3\)c0 |
| zyxel | usg40w firmware | >= 4.35, < 4.35\(aalb.3\)c0 |
| zyxel | usg60 firmware | >= 4.35, < 4.35\(aaky.3\)c0 |
| zyxel | usg60w firmware | >= 4.35, < 4.35\(aakz.3\)c0 |
| zyxel | usg110 firmware | >= 4.35, < 4.35\(aaph.3\)c0 |
| zyxel | usg210 firmware | >= 4.35, < 4.35\(aapi.3\)c0 |
| zyxel | usg310 firmware | >= 4.35, < 4.35\(aapj.3\)c0 |
| zyxel | usg1100 firmware | >= 4.35, < 4.35\(aapk.3\)c0 |
| zyxel | usg1900 firmware | >= 4.35, < 4.35\(aapl.3\)c0 |
| zyxel | usg2200 firmware | >= 4.35, < 4.35\(abae.3\)c0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cwe.mitre.org/data/definitions/78.html(Third Party Advisory)
- https://kb.cert.org/artifacts/cve-2020-9054.html(Third Party Advisory, US Government Resource)
- https://kb.cert.org/vuls/id/498544/(Third Party Advisory, US Government Resource)
- https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/(Exploit, Third Party Advisory)
- https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9054(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2020-9054, the weblogin.cgi component on Zyxel NAS devices fails to sanitize the username parameter, allowing an attacker to inject arbitrary OS commands that are executed with root privileges on the device.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2020-9054 is remotely exploitable without authentication and without any user interaction, making it trivially weaponizable by automated attack tools and botnets. The vulnerability grants attackers complete control over the affected Zyxel NAS device, including the ability to read, modify, or delete all stored data, install persistent backdoors, and use the compromised device as a pivot point for lateral movement into the internal network. Given that NAS devices typically store sensitive business and personal files, a successful exploit can lead to catastrophic data breaches and ransomware encryption of critical backup infrastructure. The confirmed use of CVE-2020-9054 in ransomware campaigns, combined with the EPSS score of 94.3% (99.9th percentile), underscores that this vulnerability is actively and widely exploited in the wild.
Exploit Maturity
CVE-2020-9054 is actively exploited in the wild and has been confirmed as a ransomware attack vector by CISA. The Emotet botnet and other threat actors have been documented leveraging this vulnerability to compromise Zyxel NAS devices for ransomware deployment and cryptomining operations. Public exploit code is widely available, and the EPSS score of 94.3% (99.9th percentile) reflects near-certain exploitation probability. The simplicity of the exploit — a single HTTP request to the weblogin.cgi endpoint — makes it accessible to even low-skilled attackers.
Remediation
- Apply the firmware update from Zyxel immediately as required by the CISA KEV directive. For devices that have reached end-of-life and no longer receive updates, disconnect the device from the network and replace it with a supported model.
- If immediate patching is not possible, restrict network access to the NAS web interface by placing the device behind a firewall and blocking external access to ports 80 and 443 on the NAS device.
- Audit all files stored on affected Zyxel NAS devices for signs of tampering, encryption, or unauthorized access, particularly if the device was internet-facing before patching.
- Change all credentials stored on or accessible from the NAS device, as attackers with root access could have harvested stored passwords and authentication tokens.
- Implement network segmentation to isolate NAS and storage devices from general network traffic, and deploy monitoring to detect anomalous command execution or outbound connections from storage infrastructure.
Technical Details
CVE-2020-9054 exploits an OS command injection flaw (CWE-78) in the weblogin.cgi script on Zyxel NAS devices. The vulnerability exists because the username parameter submitted during authentication is passed directly into a system command without proper sanitization or escaping of shell metacharacters. An attacker can inject arbitrary commands by including shell metacharacters such as semicolons or backticks in the username field, which are then executed with root privileges on the underlying Linux operating system. The attack requires only a single crafted HTTP POST request to the weblogin.cgi endpoint, making it trivially exploitable without authentication or user interaction. Multiple Zyxel NAS models are affected, including the NAS326, NAS520, NAS540, and NAS542 product lines.
Frequently Asked Questions
Is CVE-2020-9054 being actively exploited?
Yes, CVE-2020-9054 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. It has been confirmed as a ransomware attack vector, with threat actors including the Emotet botnet leveraging this vulnerability to compromise Zyxel NAS devices. The EPSS score of 94.3% (99.9th percentile) confirms extremely high exploitation activity.
What products are affected by CVE-2020-9054?
CVE-2020-9054 affects multiple Zyxel NAS (Network Attached Storage) device models, including NAS326, NAS520, NAS540, and NAS542 product lines running firmware versions prior to the security patch. Any Zyxel NAS device with the vulnerable weblogin.cgi component exposed to the network is at risk.
How do I fix CVE-2020-9054?
Apply the latest firmware update from Zyxel for your NAS model. For end-of-life devices that no longer receive updates, Zyxel recommends disconnecting the device from the internet. If immediate patching is not possible, restrict access to the NAS web management interface to trusted IP addresses only.
How severe is CVE-2020-9054?
CVE-2020-9054 is rated CRITICAL and enables unauthenticated remote code execution with root privileges. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation, and it is a confirmed ransomware delivery mechanism. Organizations should treat this as an emergency requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.