← Vulnerability feed

Vulnerability record · CVE-2020-9054 · published 4 March 2020

CVE-2020-9054: ZyXEL NAS weblogin.cgi pre-auth command injection

Zyxel · Nas326 Firmware

ZyXEL NAS devices running firmware 5.21 fail to sanitize the username parameter in the weblogin.cgi CGI executable, allowing OS command injection. Because the device ships a setuid helper, injected commands can be escalated to root, making this a full remote code execution flaw on internet-reachable storage.

9.8 CVSS 3.1 Critical CISA KEV since 25 Mar 2022 EPSS 100% · top 0.1% CWE-78 · OS command injection
9.8CVSS 3.1 base score, v2 10.0
100%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
27Affected product versions listed by NVD
11References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityPre-authentication root-level remote code execution with a CVSS of 9.8, KEV listing and near-certain EPSS probability makes this an urgent patch-or-isolate case.

What it is

ZyXEL NAS devices running firmware 5.21 fail to sanitize the username parameter in the weblogin.cgi CGI executable, allowing OS command injection. Because the device ships a setuid helper, injected commands can be escalated to root, making this a full remote code execution flaw on internet-reachable storage.

Impact

A remote, unauthenticated attacker can execute arbitrary code with root privileges on the device, gaining full control of stored data and the appliance itself.

Attack surface

Reachable over the network via crafted HTTP GET or POST requests to weblogin.cgi; no authentication or user interaction is required, and the description notes a victim merely visiting a malicious website can trigger compromise of a reachable device.

Exploitation

CVE-2020-9054 is listed in CISA KEV (added 2022-03-25) and has an EPSS 30-day probability of 0.99988, with a reference tagged Exploit; no ransomware campaign use is documented.

What to do

  • Apply the vendor firmware updates for NAS326, NAS520, NAS540 and NAS542 immediately.
  • Retire or isolate end-of-support models (NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325, NSA325v2) that have no fix.
  • Remove direct internet exposure of NAS management interfaces; place them behind VPN or restrict to trusted management networks.
  • Block or filter inbound requests to weblogin.cgi at the perimeter and disable remote management where not required.
  • Monitor vendor advisories for any further firmware releases covering the affected models.

Detection

  • Inspect HTTP logs for GET or POST requests to weblogin.cgi containing shell metacharacters in the username parameter.
  • Alert on unexpected outbound connections or new processes spawned by the device's web server user.
  • Hunt for anomalous command execution or file creation on NAS devices, especially activity preceding use of the setuid helper.
  • Correlate device access logs with known scanning activity targeting weblogin.cgi.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2020-9054 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "Zyxel Multiple NAS Devices OS Command Injection Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.

Affected products

27 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cwe.mitre.org/data/definitions/78.html Third Party Advisory
https://kb.cert.org/artifacts/cve-2020-9054.html Third Party AdvisoryUS Government Resource
https://kb.cert.org/vuls/id/498544/ Third Party AdvisoryUS Government Resource
https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/ ExploitThird Party Advisory
https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml Vendor Advisory
https://cwe.mitre.org/data/definitions/78.html Third Party Advisory
https://kb.cert.org/artifacts/cve-2020-9054.html Third Party AdvisoryUS Government Resource
https://kb.cert.org/vuls/id/498544/ Third Party AdvisoryUS Government Resource
https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/ ExploitThird Party Advisory
https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9054 US Government Resource

Track CVE-2020-9054 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-27992Zyxel NAS devices pre-auth OS command injectionZyxel NAS326, NAS540 and NAS542 firmware contain a pre-authentication OS command injection flaw (CWE-78). A crafted HTTP request lets an unauthentica…KEVEPSS 83%analysed9.8CVE-2023-33009Zyxel firewall notification function buffer overflowA buffer overflow in the notification function of multiple Zyxel firewall and VPN firmware lines (ATP, USG FLEX, USG20(W)-VPN, VPN, ZyWALL/USG) allow…KEVEPSS 28%analysed9.8CVE-2023-33010Zyxel firewall ID processing buffer overflow allows unauthenticated RCEA classic buffer overflow (CWE-120) exists in the ID processing function of multiple Zyxel firewall firmware lines, including ATP, USG FLEX, USG20(W)…KEVEPSS 29%analysed9.8CVE-2023-28771Zyxel firewall firmware OS command injection via crafted packetsZyxel ZyWALL/USG, VPN, USG FLEX and ATP series firmware mishandle error messages, allowing OS command injection. An unauthenticated remote attacker c…KEVEPSS 99%analysed9.8CVE-2022-30525Zyxel firewall CGI OS command injectionThe CGI program in multiple Zyxel firewall and VPN firmware lines fails to neutralize OS command syntax, allowing command injection. The flaw affects…KEVEPSS 100%analysed9.8CVE-2020-29583Zyxel USG and ATP firmware hard-coded admin credentialZyxel USG and ATP firmware version 4.60 ships an undocumented account (zyfwp) whose password is stored in cleartext in the firmware and cannot be cha…KEVEPSS 90%analysed9.8CVE-2024-6342Zyxel nas326 firmware os command injection vulnerability**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 …EPSS 2.1%9.8CVE-2024-29973Zyxel NAS setCookie parameter OS command injectionZyxel NAS326 and NAS542 firmware contain an OS command injection flaw in the setCookie parameter, reachable via a crafted HTTP POST request. The affe…EPSS 86%analysed

Source: NIST National Vulnerability Database (record CVE-2020-9054), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.