CVE-2020-9054KEV · OVERDUECWE-78command-injection

Zyxel Multiple NAS Devices OS Command Injection Vulnerability

Critical · published March 5, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.

1652
days past CISA
deadline
CVSS v3.1
9.8
EPSS
100%
Percentile
100.0
In the wild
Confirmed
What it is

🚨 A pre-authentication command injection flaw in ZyXEL NAS devices could let attackers execute arbitrary code without breaking a sweat — all from the comfort of their own couch! 🔥 Think of it like a restaurant that accepts any name for a reservation without checking it against their system. A sneaky diner could waltz in by just pretending to be anyone at all, potentially getting access to the kitchen and running amok! An attacker could seize control of the device, running arbitrary commands with full root privileges — that's like having the keys to the entire restaurant! If these NAS devices are exposed to the internet, the risk escalates dramatically, allowing unauthorized access that could lead to data theft or complete system takeovers. An unprotected ZyXEL could become a hacker's playground in no time!

Put simply

Think of it like a restaurant that accepts any name for a reservation without checking it against their system. A sneaky diner could waltz in by just pretending to be anyone at all, potentially getting access to the kitchen and running amok! This command injection vulnerability arises because the 'weblogin.cgi' CGI executable does not properly sanitize the username parameter, enabling attackers to exploit it and execute commands with the privileges of the web server, which can leverage setuid utilities to gain root access.

What to do

An attacker could seize control of the device, running arbitrary commands with full root privileges — that's like having the keys to the entire restaurant! If these NAS devices are exposed to the internet, the risk escalates dramatically, allowing unauthorized access that could lead to data theft or complete system takeovers. An unprotected ZyXEL could become a hacker's playground in no time! Update affected ZyXEL NAS devices to the latest firmware (V5.21(AAZF.7)C0 for NAS326, V5.21(AASZ.3)C0 for NAS520, V5.21(AATB.4)C0 for NAS540, and V5.21(ABAG.4)C0 for NAS542) immediately. For end-of-support models, consider replacing or securing them in a different manner to mitigate exposure. Take proactive measures to limit access to these devices from the internet. You've got this! Secure your devices and protect your network like the hero you are! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99988 · 100.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2020-03-05T01:15Z
KEV added
2022-03-25 · due 2022-04-15
Affected products (27)
ProductVersionsFixed in
zyxel/nas326_firmware< 5.21\(aazf.10\)c05.21\(aazf.10\)c0
zyxel/nas520_firmware< 5.21\(aasz.3\)c05.21\(aasz.3\)c0
zyxel/nas540_firmware< 5.21\(aatb.7\)c05.21\(aatb.7\)c0
zyxel/nas542_firmware< 5.21\(abag.7\)c05.21\(abag.7\)c0
zyxel/atp100_firmware≥ 4.35, < 4.35\(abps.3\)c04.35\(abps.3\)c0
zyxel/atp200_firmware≥ 4.35, < 4.35\(abfw.3\)c04.35\(abfw.3\)c0
zyxel/atp500_firmware≥ 4.35, < 4.35\(abfu.3\)c04.35\(abfu.3\)c0
zyxel/atp800_firmware≥ 4.35, < 4.35\(abiq.3\)c04.35\(abiq.3\)c0
zyxel/usg20-vpn_firmware≥ 4.35, < 4.35\(abaq.3\)c04.35\(abaq.3\)c0
zyxel/usg20w-vpn_firmware≥ 4.35, < 4.35\(abar.3\)c04.35\(abar.3\)c0
zyxel/usg40_firmware≥ 4.35, < 4.35\(aala.3\)c04.35\(aala.3\)c0
zyxel/usg40w_firmware≥ 4.35, < 4.35\(aalb.3\)c04.35\(aalb.3\)c0
zyxel/usg60_firmware≥ 4.35, < 4.35\(aaky.3\)c04.35\(aaky.3\)c0
zyxel/usg60w_firmware≥ 4.35, < 4.35\(aakz.3\)c04.35\(aakz.3\)c0
zyxel/usg110_firmware≥ 4.35, < 4.35\(aaph.3\)c04.35\(aaph.3\)c0
zyxel/usg210_firmware≥ 4.35, < 4.35\(aapi.3\)c04.35\(aapi.3\)c0
zyxel/usg310_firmware≥ 4.35, < 4.35\(aapj.3\)c04.35\(aapj.3\)c0
zyxel/usg1100_firmware≥ 4.35, < 4.35\(aapk.3\)c04.35\(aapk.3\)c0
zyxel/usg1900_firmware≥ 4.35, < 4.35\(aapl.3\)c04.35\(aapl.3\)c0
zyxel/usg2200_firmware≥ 4.35, < 4.35\(abae.3\)c04.35\(abae.3\)c0
zyxel/vpn50_firmware≥ 4.35, < 4.35\(abhl.3\)c04.35\(abhl.3\)c0
zyxel/vpn100_firmware≥ 4.35, < 4.35\(abfv.3\)c04.35\(abfv.3\)c0
zyxel/vpn300_firmware≥ 4.35, < 4.35\(abfc.3\)c04.35\(abfc.3\)c0
zyxel/vpn1000_firmware≥ 4.35, < 4.35\(abip.3\)c04.35\(abip.3\)c0
zyxel/zywall110_firmware≥ 4.35, < 4.35\(aaaa.3\)c04.35\(aaaa.3\)c0
zyxel/zywall310_firmware≥ 4.35, < 4.35\(aaab.3\)c04.35\(aaab.3\)c0
zyxel/zywall1100_firmware≥ 4.35, < 4.35\(aaac.3\)c04.35\(aaac.3\)c0
References (11)
EPSS history
Timeline
  • 25 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 15
    kev
  • 04 MAR 19:30Z
    ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi
    cvelistv5