Security Experts:

Connect with us

Hi, what are you looking for?



Zyxel Patches Zero-Day Vulnerability in Network Storage Products

Networking devices vendor Zyxel has released patches for several network attached storage (NAS) devices to address a critical vulnerability that is already being exploited by cybercriminals.

Networking devices vendor Zyxel has released patches for several network attached storage (NAS) devices to address a critical vulnerability that is already being exploited by cybercriminals.

Tracked as CVE-2020-9054, the issue is a remote code execution flaw that can be exploited without authentication and which resides in the weblogin.cgi CGI executable failing to properly sanitize the username parameter passed to it. 

Thus, if certain characters are included in the username, the vulnerability can be exploited for command injection with the privileges of the web server. An attacker can then leverage a setuid utility included on the device to run any command with root privileges, CERT Coordination Center (CERT/CC) explains. 

“A remote code execution vulnerability was identified in the weblogin.cgi program of Zyxel NAS products running firmware version 5.21 and earlier. Missing authentication for the program could allow attackers to perform remote code execution via OS command injection,” Zyxel explains in an advisory.

A remote attacker could execute arbitrary code on a vulnerable Zyxel device by sending a specially-crafted HTTP POST or GET request. The bug could be triggered even if the attacker does not have direct connectivity to the device (if the device is not exposed to the web), but the victim connects to a malicious website. 

An exploit for the vulnerability has been available for sale on underground forums for a while now, priced at $20,000, security reporter Brian Krebs, who alerted Zyxel, DHS, and CERT/CC on the flaw, reveals. 

Krebs also says that groups specializing in deploying ransomware at scale have shown interest in the exploit, and that the Emotet gang would intend to include the exploit in their malware. 

This week, Zyxel released patches for four of the devices found vulnerable, namely NAS326, NAS520, NAS540, and NAS542. 

However, ten other NAS products from the vendor are no longer supported and won’t receive fixes. These include NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2.

Mitigation steps for these devices include blocking access to the web interface (80/tcp and 443/tcp) and ensuring that the NAS is not exposed to the Internet. CERT/CC, which rates the vulnerability as having a CSSV score of 10, also recommends isolating from the Internet any machine that can access the vulnerable web interface.

“Do not leave the product directly exposed to the internet. If possible, connect it to a security router or firewall for additional protection,” Zyxel notes. 

Related: Zyxel Devices Can Be Hacked via DNS Requests, Hardcoded Credentials

Related: SOHOpelessly Broken 2.0: 125 Vulnerabilities Found in Routers, NAS Devices

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.