Main Vulnerability Database Vulnerabilities #VU25597

OS Command Injection in ZyXEL Communications Corp. products - CVE-2020-9054

Published: February 25, 2020 / Updated: October 9, 2023

Vulnerability identifier: #VU25597

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9054

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing username in the login form. A remote unauthenticated attacker can send a specially crafted HTTP request and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

NAS540
NAS542
NSA210
NSA220
NSA220+
NSA221
NSA310
NSA310S
NSA320
NSA320S
NSA325
NSA325v2
NAS520
Zyxel NAS 326

How to mitigate CVE-2020-9054

The vendor has released a hotfix for the following models:

NAS326
NAS520
NAS540
NAS542

Links to Public Exploits and PoC-codes

Exploit #9374 - CVE-2020-9054 (CVE-2020-9054 PoC for Zyxel) (October 9, 2023)

External References

https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml

Related Security Bulletins

Remote code execution in multiple Zyxel storage devices