CVE-2020-9054

🗓️ 04 Mar 2020 20:15:10Reported by [email protected]Type

Multiple ZyXEL NAS devices running firmware version 5.21 pre-authentication command injection vulnerabilit

Reporter	Title	Published	Views	Family All 30
GithubExploit	Exploit for CVE-2014-8361	31 Mar 202611:18	–	githubexploit
ATTACKERKB	VU#498544 ZyXEL pre-authentication command injection in weblogin.cgi	26 Feb 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-9054	20 Feb 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the weblogin.cgi component in NAS (Network Attached Storage) storage systems and micro-programming software for Ethernet interfaces of UTM, ATP, and VPN devices allows a hacker to execute arbitrary code.	20 Mar 202000:00	–	bdu_fstec
Circl	CVE-2020-9054	26 Feb 202010:20	–	circl
CISA KEV Catalog	Zyxel Multiple NAS Devices OS Command Injection Vulnerability	25 Mar 202200:00	–	cisa_kev
Check Point Advisories	ZyXEL NAS Command Injection (CVE-2020-9054)	26 Feb 202000:00	–	checkpoint_advisories
CVE	CVE-2020-9054	4 Mar 202019:30	–	cve
Cvelist	CVE-2020-9054 ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi	4 Mar 202019:30	–	cvelist
Krebs on Security	Zyxel Fixes 0day in Network Storage Devices	24 Feb 202017:13	–	krebs

NVD

Node

AND

zyxel nas326_firmwareRange<5.21(aazf.7)c0

zyxel nas326Match-

Node

AND

zyxel nas520_firmwareRange<5.21(aasz.3)c0

zyxel nas520Match-

Node

AND

zyxel nas540_firmwareRange<5.21(aatb.4)c0

zyxel nas540Match-

Node

AND

zyxel nas542_firmwareRange<5.21(abag.4)c0

zyxel nas542Match-

Node

AND

zyxel atp100_firmwareRange4.35–4.35(abps.3)c0

zyxel atp100Match-

Node

AND

zyxel atp200_firmwareRange4.35–4.35(abfw.3)c0

zyxel atp200Match-

Node

AND

zyxel atp500_firmwareRange4.35–4.35(abfu.3)c0

zyxel atp500Match-

Node

AND

zyxel atp800_firmwareRange4.35–4.35(abiq.3)c0

zyxel atp800Match-

Node

AND

zyxel usg20-vpn_firmwareRange4.35–4.35(abaq.3)c0

zyxel usg20-vpnMatch-

Node

AND

zyxel usg20w-vpn_firmwareRange4.35–4.35(abar.3)c0

zyxel usg20w-vpnMatch-

Node

AND

zyxel usg40_firmwareRange4.35–4.35(aala.3)c0

zyxel usg40Match-

Node

AND

zyxel usg40w_firmwareRange4.35–4.35(aalb.3)c0

zyxel usg40wMatch-

Node

AND

zyxel usg60_firmwareRange4.35–4.35(aaky.3)c0

zyxel usg60Match-

Node

AND

zyxel usg60w_firmwareRange4.35–4.35(aakz.3)c0

zyxel usg60wMatch-

Node

AND

zyxel usg110_firmwareRange4.35–4.35(aaph.3)c0

zyxel usg110Match-

Node

AND

zyxel usg210_firmwareRange4.35–4.35(aapi.3)c0

zyxel usg210Match-

Node

AND

zyxel usg310_firmwareRange4.35–4.35(aapj.3)c0

zyxel usg310Match-

Node

AND

zyxel usg1100_firmwareRange4.35–4.35(aapk.3)c0

zyxel usg1100Match-

Node

AND

zyxel usg1900_firmwareRange4.35–4.35(aapl.3)c0

zyxel usg1900Match-

Node

AND

zyxel usg2200_firmwareRange4.35–4.35(abae.3)c0

zyxel usg2200Match-

Node

AND

zyxel vpn50_firmwareRange4.35–4.35(abhl.3)c0

zyxel vpn50Match-

Node

AND

zyxel vpn100_firmwareRange4.35–4.35(abfv.3)c0

zyxel vpn100Match-

Node

AND

zyxel vpn300_firmwareRange4.35–4.35(abfc.3)c0

zyxel vpn300Match-

Node

AND

zyxel vpn1000_firmwareRange4.35–4.35(abip.3)c0

zyxel vpn1000Match-

Node

AND

zyxel zywall110_firmwareRange4.35–4.35(aaaa.3)c0

zyxel zywall110Match-

Node

AND

zyxel zywall310_firmwareRange4.35–4.35(aaab.3)c0

zyxel zywall310Match-

Node

AND

zyxel zywall1100_firmwareRange4.35–4.35(aaac.3)c0

zyxel zywall1100Match-

Source	Link
kb	www.kb.cert.org/artifacts/cve-2020-9054.html
krebsonsecurity	www.krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
zyxel	www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml
kb	www.kb.cert.org/vuls/id/498544/
cwe	www.cwe.mitre.org/data/definitions/78.html

17 Jun 2026 03:27Current

10High risk

Vulners AI Score10

CVSS 3.19.8

CVSS 210

EPSS0.99986

CWE-78