Unrated

ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

Type: advisorySource: Official CVE ListKnown exploited1 source record

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 be

Announced 4 Mar 2020Group revision 1

Original source ↗

CVE-2020-9054

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2020-9054

NAS326

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NAS520

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NAS540

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NAS542

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA210

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA220

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA220+

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA221

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA310

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA320

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA320S

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA325

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

NSA325v2

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "ZyXEL",
    "product": "NAS326",
    "versions": [
      {
        "status": "affected",
        "version": "V5.21(AAZF.7)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V5.21(AAZF.7)C0"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NAS520",
    "versions": [
      {
        "status": "affected",
        "version": "V5.21(AASZ.3)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V5.21(AASZ.3)C0"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NAS540",
    "versions": [
      {
        "status": "affected",
        "version": "V5.21(AATB.4)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V5.21(AATB.4)C0"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NAS542",
    "versions": [
      {
        "status": "affected",
        "version": "V5.21(ABAG.4)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V5.21(ABAG.4)C0"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA210",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA220",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA220+",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA221",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA310",
    "versions": [
      {
        "status": "affected",
        "version": "V4.75(AALH.2)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V4.75(AALH.2)C0"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA320",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA320S",
    "versions": [
      {
        "status": "affected",
        "version": "V4.75(AANV.2)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V4.75(AANV.2)C0"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA325",
    "versions": [
      {
        "status": "affected",
        "version": "V4.81(AAAJ.1)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V4.81(AAAJ.1)C0"
      }
    ]
  },
  {
    "vendor": "ZyXEL",
    "product": "NSA325v2",
    "versions": [
      {
        "status": "affected",
        "version": "V4.81(AALS.1)C0",
        "versionType": "custom",
        "lessThanOrEqual": "V4.81(AALS.1)C0"
      }
    ]
  }
]

Related CVEs: CVE-2020-9054
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2020-9054 · Unrated

Multiple Network-Attached Storage (NAS) Devices · Known exploited (CISA KEV)

Event: #12044 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:01:28 GMT
Publisher date: Wed, 04 Mar 2020 19:30:18 GMT

Read the original announcement

Revision history

25 Oct 2026CVE-2020-9054 · Revision 1Source updated