ZyXEL NAS Devices weblogin.cgi Pre-Authentication Remote Code Execution (RCE) Vulnerability (CVE-2020-9054)
Executive & SecOps Summary
SECOPS ASSESSMENTZyXEL NAS devices (NAS326, NAS520, NAS540, NAS542) running firmware versions prior to 5.21, and all end-of-support NSA series models
An unauthenticated remote attacker can execute arbitrary OS commands with root privileges by sending a specially crafted HTTP request
Immediately upgrade active models to the patched firmware versions, and isolate or replace end-of-support (EoL) models from the network
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
For supported models, immediately apply the latest firmware updates provided by the ZyXEL Download Center.
# [Reference] Check the current firmware version via the device CLI
# It is highly recommended to perform the actual upgrade via the Web GUI 'Firmware Update' menu.
cat /etc/firmware_version2. Temporary Workaround & Hardening Configuration
For end-of-support (EoL) models or when immediate patching is not feasible, restrict network access to the NAS device and block external WAN access.
# Restrict HTTP/HTTPS access to trusted administrator IP ranges only using iptables
# Assuming eth0 is the WAN interface and 192.168.1.0/24 is the trusted subnet
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP3. Log Audit & IoC Verification Commands
Inspect web server access logs for suspicious requests targeting weblogin.cgi containing shell metacharacters.
# Scan web server access logs for weblogin.cgi requests containing shell metacharacters
grep -E 'weblogin\.cgi.*(%3B|%60|%7C|%24|;|`|\|)' /var/log/apache2/access.log /var/log/nginx/access.log 2>/dev/nullStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the weblogin.cgi CGI executable, which handles web login authentication on ZyXEL NAS devices. The program fails to properly sanitize the username parameter passed via HTTP requests before executing system commands. Consequently, if the parameter contains shell metacharacters, it leads to an OS Command Injection vulnerability (CWE-78).
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP GET or POST request targeting weblogin.cgi. By embedding shell control characters such as semicolons (;), backticks (` `), or pipes (|) along with malicious payloads into the username` parameter, the attacker triggers command execution.
Although the web server process itself does not run as the root user, ZyXEL devices include a utility with the setuid bit enabled, which can be leveraged to escalate privileges to root. Furthermore, direct connectivity to the device is not strictly required; an attacker can compromise a vulnerable NAS device inside a private network by tricking a user on the same network into visiting a malicious website that triggers cross-site requests.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability is highly severe and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog. Successful exploitation allows full administrative control (root) over the NAS device, enabling attackers to exfiltrate, modify, or delete sensitive stored data. It also allows attackers to use the compromised NAS as a pivot point to move laterally within the internal network or deploy ransomware.
Official Vendor Advisories & References
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
Frequently Asked SecOps Questions (CVE-2020-9054)
FAQQ1. How critical is CVE-2020-9054 and is it actively exploited in the wild?
CVE-2020-9054 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-9054?
Primary impacted vendors include zyxel across nas326, nas520, nas540, nas542, nsa210, nsa220, nsa220+, nsa221, nsa310, nsa310s, nsa320, nsa320s, nsa325, nsa325v2. Scope summary: ZyXEL NAS326 (before V5.21(AAZF.7)C0), NAS520 (before V5.21(AASZ.3)C0), NAS540 (before V5.21(AATB.4)C0), NAS542 (before V5.21(ABAG.4)C0), and EoL NSA series (NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325, NSA325v2)
Q3. What temporary mitigations or workarounds exist for CVE-2020-9054 before patching?
[Mitigation] Immediately upgrade active models to the patched firmware versions, and isolate or replace end-of-support (EoL) models from the network Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-9054
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zyxel)
View Category →Zyxel GS1900 Series Switch CGI Stack-based Buffer Overflow Remote Code Execution (RCE) Advisory (CVE-2026-7273)
[Affected Scope] Zyxel GS1900-48HPv2 firmware versions up to 2.90(ABTQ.1)C0.
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089) Security Advisory
[Affected Scope] Fortinet FortiSandbox (5.0.0 to 5.0.5, 4.4.0 to 4.4.8, 4.2 all versions), FortiSandbox Cloud and PaaS (5.0.4 to 5.0.5)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.