CVE-2020-9054

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 0/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.

CISA Known Exploited Vulnerability

Vendor / Product Zyxel — Multiple Network-Attached Storage (NAS) Devices

Date Added 2022-03-25

Remediation Due 2022-04-15

https://nvd.nist.gov/vuln/detail/CVE-2020-9054

Weakness Classification (1)

CWE-78

Affected Software (27)

Vendor	Product	Version
zyxel	atp100_firmware	4.35 – 4.35\(abps.3\)c0
zyxel	atp200_firmware	4.35 – 4.35\(abfw.3\)c0
zyxel	atp500_firmware	4.35 – 4.35\(abfu.3\)c0
zyxel	atp800_firmware	4.35 – 4.35\(abiq.3\)c0
zyxel	nas326_firmware	< 5.21\(aazf.10\)c0
zyxel	nas520_firmware	< 5.21\(aasz.3\)c0
zyxel	nas540_firmware	< 5.21\(aatb.7\)c0
zyxel	nas542_firmware	< 5.21\(abag.7\)c0
zyxel	usg1100_firmware	4.35 – 4.35\(aapk.3\)c0
zyxel	usg110_firmware	4.35 – 4.35\(aaph.3\)c0
zyxel	usg1900_firmware	4.35 – 4.35\(aapl.3\)c0
zyxel	usg20-vpn_firmware	4.35 – 4.35\(abaq.3\)c0
zyxel	usg20w-vpn_firmware	4.35 – 4.35\(abar.3\)c0
zyxel	usg210_firmware	4.35 – 4.35\(aapi.3\)c0
zyxel	usg2200_firmware	4.35 – 4.35\(abae.3\)c0
zyxel	usg310_firmware	4.35 – 4.35\(aapj.3\)c0
zyxel	usg40_firmware	4.35 – 4.35\(aala.3\)c0
zyxel	usg40w_firmware	4.35 – 4.35\(aalb.3\)c0
zyxel	usg60_firmware	4.35 – 4.35\(aaky.3\)c0
zyxel	usg60w_firmware	4.35 – 4.35\(aakz.3\)c0
zyxel	vpn1000_firmware	4.35 – 4.35\(abip.3\)c0
zyxel	vpn100_firmware	4.35 – 4.35\(abfv.3\)c0
zyxel	vpn300_firmware	4.35 – 4.35\(abfc.3\)c0
zyxel	vpn50_firmware	4.35 – 4.35\(abhl.3\)c0
zyxel	zywall1100_firmware	4.35 – 4.35\(aaac.3\)c0
zyxel	zywall110_firmware	4.35 – 4.35\(aaaa.3\)c0
zyxel	zywall310_firmware	4.35 – 4.35\(aaab.3\)c0