Critical · published March 5, 2020
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 A pre-authentication command injection flaw in ZyXEL NAS devices could let attackers execute arbitrary code without breaking a sweat — all from the comfort of their own couch! 🔥 Think of it like a restaurant that accepts any name for a reservation without checking it against their system. A sneaky diner could waltz in by just pretending to be anyone at all, potentially getting access to the kitchen and running amok! An attacker could seize control of the device, running arbitrary commands with full root privileges — that's like having the keys to the entire restaurant! If these NAS devices are exposed to the internet, the risk escalates dramatically, allowing unauthorized access that could lead to data theft or complete system takeovers. An unprotected ZyXEL could become a hacker's playground in no time!
Think of it like a restaurant that accepts any name for a reservation without checking it against their system. A sneaky diner could waltz in by just pretending to be anyone at all, potentially getting access to the kitchen and running amok! This command injection vulnerability arises because the 'weblogin.cgi' CGI executable does not properly sanitize the username parameter, enabling attackers to exploit it and execute commands with the privileges of the web server, which can leverage setuid utilities to gain root access.
An attacker could seize control of the device, running arbitrary commands with full root privileges — that's like having the keys to the entire restaurant! If these NAS devices are exposed to the internet, the risk escalates dramatically, allowing unauthorized access that could lead to data theft or complete system takeovers. An unprotected ZyXEL could become a hacker's playground in no time! Update affected ZyXEL NAS devices to the latest firmware (V5.21(AAZF.7)C0 for NAS326, V5.21(AASZ.3)C0 for NAS520, V5.21(AATB.4)C0 for NAS540, and V5.21(ABAG.4)C0 for NAS542) immediately. For end-of-support models, consider replacing or securing them in a different manner to mitigate exposure. Take proactive measures to limit access to these devices from the internet. You've got this! Secure your devices and protect your network like the hero you are! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zyxel/nas326_firmware | < 5.21\(aazf.10\)c0 | 5.21\(aazf.10\)c0 |
| zyxel/nas520_firmware | < 5.21\(aasz.3\)c0 | 5.21\(aasz.3\)c0 |
| zyxel/nas540_firmware | < 5.21\(aatb.7\)c0 | 5.21\(aatb.7\)c0 |
| zyxel/nas542_firmware | < 5.21\(abag.7\)c0 | 5.21\(abag.7\)c0 |
| zyxel/atp100_firmware | ≥ 4.35, < 4.35\(abps.3\)c0 | 4.35\(abps.3\)c0 |
| zyxel/atp200_firmware | ≥ 4.35, < 4.35\(abfw.3\)c0 | 4.35\(abfw.3\)c0 |
| zyxel/atp500_firmware | ≥ 4.35, < 4.35\(abfu.3\)c0 | 4.35\(abfu.3\)c0 |
| zyxel/atp800_firmware | ≥ 4.35, < 4.35\(abiq.3\)c0 | 4.35\(abiq.3\)c0 |
| zyxel/usg20-vpn_firmware | ≥ 4.35, < 4.35\(abaq.3\)c0 | 4.35\(abaq.3\)c0 |
| zyxel/usg20w-vpn_firmware | ≥ 4.35, < 4.35\(abar.3\)c0 | 4.35\(abar.3\)c0 |
| zyxel/usg40_firmware | ≥ 4.35, < 4.35\(aala.3\)c0 | 4.35\(aala.3\)c0 |
| zyxel/usg40w_firmware | ≥ 4.35, < 4.35\(aalb.3\)c0 | 4.35\(aalb.3\)c0 |
| zyxel/usg60_firmware | ≥ 4.35, < 4.35\(aaky.3\)c0 | 4.35\(aaky.3\)c0 |
| zyxel/usg60w_firmware | ≥ 4.35, < 4.35\(aakz.3\)c0 | 4.35\(aakz.3\)c0 |
| zyxel/usg110_firmware | ≥ 4.35, < 4.35\(aaph.3\)c0 | 4.35\(aaph.3\)c0 |
| zyxel/usg210_firmware | ≥ 4.35, < 4.35\(aapi.3\)c0 | 4.35\(aapi.3\)c0 |
| zyxel/usg310_firmware | ≥ 4.35, < 4.35\(aapj.3\)c0 | 4.35\(aapj.3\)c0 |
| zyxel/usg1100_firmware | ≥ 4.35, < 4.35\(aapk.3\)c0 | 4.35\(aapk.3\)c0 |
| zyxel/usg1900_firmware | ≥ 4.35, < 4.35\(aapl.3\)c0 | 4.35\(aapl.3\)c0 |
| zyxel/usg2200_firmware | ≥ 4.35, < 4.35\(abae.3\)c0 | 4.35\(abae.3\)c0 |
| zyxel/vpn50_firmware | ≥ 4.35, < 4.35\(abhl.3\)c0 | 4.35\(abhl.3\)c0 |
| zyxel/vpn100_firmware | ≥ 4.35, < 4.35\(abfv.3\)c0 | 4.35\(abfv.3\)c0 |
| zyxel/vpn300_firmware | ≥ 4.35, < 4.35\(abfc.3\)c0 | 4.35\(abfc.3\)c0 |
| zyxel/vpn1000_firmware | ≥ 4.35, < 4.35\(abip.3\)c0 | 4.35\(abip.3\)c0 |
| zyxel/zywall110_firmware | ≥ 4.35, < 4.35\(aaaa.3\)c0 | 4.35\(aaaa.3\)c0 |
| zyxel/zywall310_firmware | ≥ 4.35, < 4.35\(aaab.3\)c0 | 4.35\(aaab.3\)c0 |
| zyxel/zywall1100_firmware | ≥ 4.35, < 4.35\(aaac.3\)c0 | 4.35\(aaac.3\)c0 |