CVE-2020-9054
CVE-2020-9054 is a security flaw in Zyxel Multiple Network-Attached Storage (NAS) Devices, firewalls and routers for homes and small businesses. Attackers can run their own code on Zyxel Multiple Network-Attached Storage (NAS) Devices from anywhere, without logging in. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 25 Mar 2022.[1]
Zyxel Multiple Network-Attached Storage (NAS) Devices is in things households have: home and small-office routers, so the fix matters at home as much as at work. Zyxel has published a fix or advice.
Description
CISA calls it a multiple NAS devices OS command injection in Zyxel Multiple Network-Attached Storage (NAS) Devices. In its words: “Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.”[1]
The CVE record adds: “Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a…”[2]
The underlying weakness is OS command injection (CWE-78), in MITRE’s list of common software weaknesses.
It scores 9.8 out of 10 on the Common Vulnerability Scoring System, which rates it critical, scored by NVD using CVSS 3.1.[2]
Affected versions
NVD’s record doesn’t list version ranges for it; Zyxel’s advisory has them[3]. CISA names the product as Zyxel Multiple Network-Attached Storage (NAS) Devices.
Every device with Zyxel Multiple Network-Attached Storage (NAS) Devices needs the update.
Exploitation
CISA added it to its catalog of known exploited vulnerabilities on 25 Mar 2022, 751 days after it was made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 15 Apr 2022 to fix it.[1]
FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at over 99%. That’s in the top 1% of the flaws it scores.[4]
CISA assesses it as not automatable: each attack takes some work.
CISA doesn’t say who was attacked, or how.
Fix
Zyxel has published a fix or advice.[3] CISA’s required action: “Apply updates per vendor instructions.”[1]
- Update Zyxel Multiple Network-Attached Storage (NAS) Devices now.Open the router’s app, or its admin page in a browser, and look for a firmware update. Then turn on automatic updates, so the next fix arrives on its own.
- If the maker has stopped updating it, replace it.Routers stop getting fixes after a few years, and attackers keep a list of the ones that did. If there’s no newer firmware, it won’t be fixed.
Timeline
| Date | Event |
|---|---|
| The flaw is made public in the National Vulnerability Database, with a severity score of 9.8.[2] | |
| CISA adds it to its catalog of flaws known to be used in attacks.[1] | |
| CISA’s deadline for US government agencies to fix it.[1] | |
| FIRST puts the odds of it being used in attacks in the next 30 days at over 99%.[4] |
See also
Other Zyxel Multiple Network-Attached Storage (NAS) Devices flaws
- CVE-2023-27992: multiple NAS devices command injection ·
Other Zyxel flaws
- CVE-2026-7273, Zyxel GS1900 Series Switches: stack-based buffer overflow ·
- CVE-2024-40891, Zyxel DSL CPE Devices: DSL CPE OS command injection ·
- CVE-2024-40890, Zyxel DSL CPE Devices: DSL CPE OS command injection ·
- CVE-2024-11667, Zyxel Multiple Firewalls: path traversal ·
- CVE-2017-6884, Zyxel EMG2926 Routers: command injection ·
Other OS command injection flaws
- CVE-2026-110447, Collabora Online – Built-in CODE Server: online – built-in CODE server OS command injection ·
- CVE-2026-106931, EG Secure Solutions SiteGuard Server Edition: OS command injection ·
- CVE-2026-83549, SonicWall SMA1000 Appliances: OS command injection ·
- CVE-2026-49869, Kestra OSS: OSS OS command injection ·
- CVE-2026-73570, Synacor Zimbra Collaboration Suite (ZCS): OS command injection ·
Added the same day
- CVE-2022-26318, WatchGuard Firebox and XTM Appliances: arbitrary code execution ·
- CVE-2022-26143, Mitel MiCollab, MiVoice Business Express: access control ·
- CVE-2022-21999, Microsoft Windows: print spooler privilege escalation ·
- CVE-2021-42237, Sitecore XP: remote command execution ·
- CVE-2021-22941, Citrix ShareFile: improper access control ·
Every Zyxel flaw on CISA’s list · Everything added in March 2022
References
- ^ Cybersecurity and Infrastructure Security Agency. “Zyxel Multiple NAS Devices OS Command Injection Vulnerability”. Known Exploited Vulnerabilities Catalog, added 25 Mar 2022.
- ^ National Institute of Standards and Technology. “CVE-2020-9054 Detail”. National Vulnerability Database, published 4 Mar 2020.
- ^ Zyxel. Advisories and fixes: zyxel.com.
- ^ FIRST. “Exploit Prediction Scoring System”. EPSS 1.000, percentile 100.0, 31 Oct 2026.
- CVE Program. “CVE-2020-9054”. The official CVE record.
This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.