FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

Exploit
CVE-2020-9054

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Mar 4, 2020 / Updated: 57mo ago

010
CVSS 9.8EPSS 96.99%Critical
CVE info copied to clipboard

Summary

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability. The weblogin.cgi CGI executable fails to properly sanitize the username parameter, allowing command injection with the privileges of the web server. Although the web server doesn't run as root, a setuid utility can be leveraged to run any command with root privileges. This vulnerability affects several ZyXEL NAS models including NAS326, NAS520, NAS540, and NAS542 before specific firmware versions, as well as end-of-support models like NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2.

Impact

The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device with root privileges. This can be achieved by sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device. The attack can be carried out by directly connecting to an exposed device or even indirectly - for example, simply visiting a malicious website could result in the compromise of any reachable ZyXEL device from the client system. The severity is extremely high, with a CVSS v3.1 base score of 9.8 out of 10, indicating critical severity. This score reflects the ease of exploitation (network vector, low complexity, no privileges required, no user interaction) and the complete compromise of confidentiality, integrity, and availability that can result from a successful attack.

Exploitation

Multiple proof-of-concept exploits are available on krebsonsecurity.com, github.com. There is no evidence of proof of exploitation at the moment.

Patch

ZyXEL has released firmware updates to address this vulnerability for the following models: - NAS326: Update to firmware V5.21(AAZF.7)C0 or later - NAS520: Update to firmware V5.21(AASZ.3)C0 or later - NAS540: Update to firmware V5.21(AATB.4)C0 or later - NAS542: Update to firmware V5.21(ABAG.4)C0 or later However, several affected models (NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2) are end-of-support and do not have patches available.

Mitigation

1. Immediately apply the available firmware updates for supported models (NAS326, NAS520, NAS540, NAS542). 2. For end-of-support models without available patches, consider replacing the devices with supported, patched alternatives. 3. If immediate patching or replacement is not possible, implement network segmentation to isolate vulnerable devices from untrusted networks. 4. Monitor for suspicious activities or unauthorized access attempts on affected devices. 5. Ensure that ZyXEL NAS devices are not directly exposed to the internet. Use a VPN or other secure remote access method if remote access is required. 6. Regularly check for and apply security updates for all network devices, especially those providing critical services like network-attached storage.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2020-9054. See article

Feb 24, 2020 at 5:30 PM / www.hacking.reviews
Exploitation in the Wild

Attacks in the wild have been reported by CISA Known Exploited Vulnerability.

Mar 25, 2022 at 11:00 AM / CISA Known Exploited Vulnerability
EPSS

EPSS Score was set to: 97.14% (Percentile: 99.7%)

Oct 17, 2023 at 12:31 AM
Threat Intelligence Report

The vulnerability CVE-2020-9054 is a critical zero-day vulnerability affecting ZyXEL Communications Corp. It has been exploited in the wild by the Emotet ransomware group, with no proof-of-concept exploits available. There are currently no known mitigations, detections, or patches available, and it may have downstream impacts on other third-party vendors or technology. See article

Jan 8, 2024 at 4:47 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (731233)

Mar 8, 2024 at 12:00 AM
Static CVE Timeline Graph

Affected Systems

Zyxel/usg60w_firmware
+null more

Exploits

https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
+null more

Patches

www.zyxel.com
+null more

Links to Malware Families

Mirai
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Zyxel security advisory for attacks against security appliances | Zyxel
39mo
Based on our investigation, the threat actors attempt to access a device through WAN; if successful, they then try to log in with stolen, valid credentials or bypass authentication, and to establish SSL VPN tunnels with existing or newly created users accounts, such as “zyxel_sllvpn”, “zyxel_ts”, or “zyxel_vpn_test”, to manipulate the devices’ configuration. Zyxel has been tracking the recent activity of threat actors targeting Zyxel security appliances and has released firmware patches to defend against it.
Security Vulnerability Alert and Firmware Patches - Firewall Series – Zyxel Support Campus EMEA
Google Alert - Vulnerability / 41mo
Based on our investigation, the threat actors attempt to access a device through WAN; if successful, they then try to log in with stolen, valid credentials or bypass authentication, and to establish SSL VPN tunnels with existing or newly created users accounts, such as “zyxel_sllvpn”, “zyxel_ts”, or “zyxel_vpn_test”, to manipulate the devices’ configuration. Helps users to enforce security policies against access to the web management interface and SSL VPN service from the Internet.
Zyxel Threat Intelligence
Zyxel Community / 43mo
certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be
See 28 more references

News

CVE-2020-9054 | ZyXEL NAS up to 5.20 weblogin.cgi username os command injection
VulDB Updates / 6mo
A vulnerability, which was classified as critical , was found in ZyXEL NAS up to 5.20 . This affects an unknown part of the file weblogin.cgi . The manipulation of the argument username as part of GET Request leads to os command injection. This vulnerability is uniquely identified as CVE-2020-9054 . It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
The 7777-Botnet Exploit: A New Threat to TP-Link, Xiongmai, and Hikvision
Penetration Testing / 10mo
According to VulnCheck, the 7777-Botnet is known to exploit a range of vulnerabilities in various devices, including TP-Link routers, Xiongmai devices, and Hikvision cameras . The ongoing activity of the 7777-Botnet and its ability to exploit known vulnerabilities underscore the need for vigilant cybersecurity practices.
Cybersecurity Week in Review (19/01/24)
Smarttech247 / 10mo
The cloud attack tool is capable of infiltrating servers vulnerable to known security flaws to access Laravel environment files and steal credentials for high-profile applications such as Amazon Web Services (AWS), Microsoft Office 365, SendGrid, and Twilio. A second PowerShell-based backdoor malware known as MischiefTut helps drop additional malicious tools and provides reconnaissance capabilities, allowing the threat actors to run commands on the hacked systems and send the output to attacker-controlled servers.
7777-Botnet Infection Vectors - Blog - VulnCheck
VulnCheck Blog / 10mo
Using known vulnerabilities on co-located services, we hypothesize five different CVE that the botnet might be using to spread to TP-Link, Xiongmai, and Hikvision devices, and we suggest a few CVE for more low-volume infections. And while new Xiongmai vulnerabilities have popped up in recent years (e.g. CVE-2022-26259 ), the exposed interfaces and lower volume of Xiongmai devices exploited 7777-Botnet suggests older vulnerabilities are being used.
New Findings Challenge Attribution in Denmark’s Energy Sector Cyberattacks
MrHacker / 10mo
The cyber attacks targeting the energy sector in Denmark last year may not have had the involvement of the Russia-linked Sandworm hacking group, new findings from Forescout show. The intrusions, which targeted around 22 Danish energy organizations in May 2023, occurred in two distinct waves, one which exploited a security flaw in Zyxel firewall (CVE-2023-28771) […]
See 90 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

CVSS 9.8(27010)CWE-78(3977)Zyxel(259)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial