PT-2020-1852 · Zyxel · Nsa310+10

500Mhz + 1 · Published 2020-02-26 · Updated 2026-02-07 · CVE-2020-9054

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZyXEL NAS326 versions prior to V5.21(AAZF.7)C0 ZyXEL NAS520 versions prior to V5.21(AASZ.3)C0 ZyXEL NAS540 versions prior to V5.21(AATB.4)C0 ZyXEL NAS542 versions prior to V5.21(ABAG.4)C0 ZyXEL NSA210 (affected versions not specified) ZyXEL NSA220 (affected versions not specified) ZyXEL NSA220+ (affected versions not specified) ZyXEL NSA221 (affected versions not specified) ZyXEL NSA310 (affected versions not specified) ZyXEL NSA310S (affected versions not specified) ZyXEL NSA320 (affected versions not specified) ZyXEL NSA320S (affected versions not specified) ZyXEL NSA325 (affected versions not specified) ZyXEL NSA325v2 (affected versions not specified)

Description The vulnerability is related to a pre-authentication command injection issue in the weblogin.cgi CGI executable, which fails to properly sanitize the username parameter. This allows a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device with root privileges. The issue can be exploited by sending a specially-crafted HTTP POST or GET request to a vulnerable device. It is estimated that over 100,000 devices may be affected. The vulnerability has been exploited in real-world incidents, with a working exploit available for sale on hacker forums. A new variant of Mirai IoT botnet malware, called Mukashi, has been found targeting Zyxel NAS devices using this vulnerability.

Recommendations For NAS326, update to firmware V5.21(AAZF.7)C0 or later. For NAS520, update to firmware V5.21(AASZ.3)C0 or later. For NAS540, update to firmware V5.21(AATB.4)C0 or later. For NAS542, update to firmware V5.21(ABAG.4)C0 or later. For NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325, and NSA325v2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the weblogin.cgi executable until a patch is available. Restrict access to the vulnerable weblogin.cgi CGI executable to minimize the risk of exploitation. Avoid using the username parameter in the affected API endpoint until the issue is resolved.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-01128

CVE-2020-9054

Affected Products

Nas326

Nas520

Nas540

Nas542

Nsa210

Nsa220

Nsa221

Nsa310

Nsa320S

Nsa325

Nsa325V2

References · 20

• 🔥 https://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html · Exploit
• 🔥 https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9054 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9054 · Vendor Advisory
• https://zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01128 · Security Note
• https://t.me/cveNotify/142277 · Telegram Post
• https://securitylab.ru/vulnerability/505363.php · Note
• https://t.me/thehackernews/648 · Telegram Post
• https://twitter.com/crowdfense/status/1907825422995435771 · Twitter Post
• https://t.me/aptreports/19656 · Telegram Post
• https://t.me/aptreports/15229 · Telegram Post
• https://cwe.mitre.org/data/definitions/78.html · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9054 · Note
• https://t.me/nekaspersky/363 · Telegram Post