CVE-2020-9054

Zyxel Multiple NAS Devices OS Command Injection Vulnerability

Nas326 Firmware

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can…

4. Mär 2020

Ausgewertete Quellen

• Hersteller
  https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml
• Hinweis
  https://cwe.mitre.org/data/definitions/78.html
• Hinweis
  https://kb.cert.org/artifacts/cve-2020-9054.html
• Hinweis
  https://kb.cert.org/vuls/id/498544/
• Hinweis
  https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9054
• CISA
  Zyxel Multiple NAS Devices OS Command Injection Vulnerability
• NVD
  CVE-2020-9054