CVE-2020-9054
published 2020-03-04CVE-2020-9054: Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may…
PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
99.99%
100.0th percentile
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zyxel | atp100_firmware | >= 4.35 < 4.35\(abps.3\)c0 | 4.35\(abps.3\)c0 |
| zyxel | atp200_firmware | >= 4.35 < 4.35\(abfw.3\)c0 | 4.35\(abfw.3\)c0 |
| zyxel | atp500_firmware | >= 4.35 < 4.35\(abfu.3\)c0 | 4.35\(abfu.3\)c0 |
| zyxel | atp800_firmware | >= 4.35 < 4.35\(abiq.3\)c0 | 4.35\(abiq.3\)c0 |
| zyxel | nas326 | V5.21(AAZF.7)C0 – V5.21(AAZF.7)C0 | — |
| zyxel | nas326_firmware | < 5.21\(aazf.7\)c0 | 5.21\(aazf.7\)c0 |
| zyxel | nas520 | V5.21(AASZ.3)C0 – V5.21(AASZ.3)C0 | — |
| zyxel | nas520_firmware | < 5.21\(aasz.3\)c0 | 5.21\(aasz.3\)c0 |
| zyxel | nas540 | V5.21(AATB.4)C0 – V5.21(AATB.4)C0 | — |
| zyxel | nas540_firmware | < 5.21\(aatb.4\)c0 | 5.21\(aatb.4\)c0 |
| zyxel | nas542 | V5.21(ABAG.4)C0 – V5.21(ABAG.4)C0 | — |
| zyxel | nas542_firmware | < 5.21\(abag.4\)c0 | 5.21\(abag.4\)c0 |
| zyxel | nsa210 | — | — |
| zyxel | nsa220 | — | — |
| zyxel | nsa221 | — | — |
| zyxel | nsa310 | V4.75(AALH.2)C0 – V4.75(AALH.2)C0 | — |
| zyxel | nsa320 | — | — |
| zyxel | nsa320s | V4.75(AANV.2)C0 – V4.75(AANV.2)C0 | — |
| zyxel | nsa325 | V4.81(AAAJ.1)C0 – V4.81(AAAJ.1)C0 | — |
| zyxel | nsa325v2 | V4.81(AALS.1)C0 – V4.81(AALS.1)C0 | — |
| zyxel | usg1100_firmware | >= 4.35 < 4.35\(aapk.3\)c0 | 4.35\(aapk.3\)c0 |
| zyxel | usg110_firmware | >= 4.35 < 4.35\(aaph.3\)c0 | 4.35\(aaph.3\)c0 |
| zyxel | usg1900_firmware | >= 4.35 < 4.35\(aapl.3\)c0 | 4.35\(aapl.3\)c0 |
| zyxel | usg20-vpn_firmware | >= 4.35 < 4.35\(abaq.3\)c0 | 4.35\(abaq.3\)c0 |
| zyxel | usg20w-vpn_firmware | >= 4.35 < 4.35\(abar.3\)c0 | 4.35\(abar.3\)c0 |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
SID 53495
snort↗
SID 53496
snort↗
SID 53507
snort↗
SID 53508
snort↗
SID 53509
snort↗
SID 53510
- →The exploit can be triggered via both HTTP POST and GET requests; detection should cover both methods targeting weblogin.cgi with anomalous username parameter values. ↗
- →Exploitation does not require authentication; alert on any unauthenticated access attempts to weblogin.cgi from external/internet-facing interfaces. ↗
- →Post-exploitation, watch for Mukashi-infected devices connecting to a C2 server and receiving commands to scan for other vulnerable IoT devices or launch DDoS attacks on specific TCP ports. ↗
- →Exploitation can be triggered via drive-by: a victim merely visiting a malicious website can cause their browser to send crafted requests to a reachable Zyxel NAS; monitor for cross-origin requests to NAS management interfaces. ↗
- →Check Point IPS signature 'ZyXEL NAS Command Injection (CVE-2020-9054)' is available for blocking exploitation attempts. ↗
- ·The web server on affected Zyxel NAS devices does not run as root, but a bundled setuid utility can be abused post-exploitation to escalate to root; detection/response should assume full root-level compromise. ↗
- ·Many affected Zyxel NAS models are end-of-support and will not receive patches (NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325, NSA325v2); these devices remain permanently vulnerable. ↗
- ·Patched firmware versions are: NAS326 V5.21(AAZF.7)C0, NAS520 V5.21(AASZ.3)C0, NAS540 V5.21(AATB.4)C0, NAS542 V5.21(ABAG.4)C0; devices running earlier firmware remain vulnerable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w6h5-rjp3-hxvc: Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5
ghsa_unreviewed·2022-05-24
CVE-2020-9054 [HIGH] CWE-78 GHSA-w6h5-rjp3-hxvc: Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can
VulnCheck
Zyxel Multiple NAS Devices OS Command Injection Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-9054 [CRITICAL] CWE-78 Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Affected: Zyxel Multiple Network-Attached Storage (NAS) Devices
Required Action: Apply updates per vendor instructions.
Exploitation References: https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/; https://unit42.paloaltonetworks.com/new-mirai-variant-mukashi/; https://www.trendmicro.com/vinfo/fr/security/news/internet-of-things/mirai-updates-new-variant-mukashi-targets-nas-devices-new-vulnerability-exploited-in-gpon-routers-upx-packed-fbot; https://api.vulncheck.com/v3/index/sans-dshield?cve=CVE-2020-9054
CISA
Zyxel Multiple NAS Devices OS Command Injection Vulnerability
cisa·2022-03-25·CVSS 9.8
CVE-2020-9054 [CRITICAL] CWE-78 Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Vulnerability: Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Affected: Zyxel Multiple Network-Attached Storage (NAS) Devices
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-9054
Remediation Due Date: 2022-04-15
Suricata
ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M2
suricata·2020-03-12·CVSS 9.8
CVE-2020-9054 [CRITICAL] ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M2
ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M2
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/adv,/cgi-bin/weblogin.cgi"; startswith; fast_pattern; http.request_body; content:"username="; startswith; pcre:"/^.{0,18}(?:\x27|%27)(?:\x3b|%3[Bb])/R"; reference:cve,2020-9054; reference:url,www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml; reference:url,www.kb.cert.org/vuls/id/498544/; classtype:attempted-admin; sid:2029617; rev:3; metadata:attack_target Networking_Equipment, created_at 2020_03_12, cve CVE_2020_9054, deployment Perimeter, confidence Medium, signature_severity Major, tag CISA_KEV, updated
Suricata
ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M1
suricata·2020-03-12·CVSS 9.8
CVE-2020-9054 [CRITICAL] ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M1
ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M1
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/adv,/cgi-bin/weblogin.cgi?username="; startswith; fast_pattern; pcre:"/^.{0,18}(?:\x27|%27)(?:\x3b|%3[Bb])/R"; reference:cve,2020-9054; reference:url,www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml; reference:url,www.kb.cert.org/vuls/id/498544/; classtype:attempted-admin; sid:2029616; rev:3; metadata:attack_target Networking_Equipment, created_at 2020_03_12, cve CVE_2020_9054, deployment Perimeter, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2025_07_10;)
Nuclei
Zyxel NAS Firmware 5.21- Remote Code Execution
nuclei·CVSS 9.8
CVE-2020-9054 [CRITICAL] Zyxel NAS Firmware 5.21- Remote Code Execution
Zyxel NAS Firmware 5.21- Remote Code Execution
Multiple Zyxel network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the Zyxel device. Although the web server does not run as the root user, Zyyxel devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be as
Trendmicro
Der Untergrundmarkt für Exploits
blogs_trendmicro·2021-09-07·CVSS 9.8
[CRITICAL] Der Untergrundmarkt für Exploits
Ausnutzung von Schwachstellen
## Der Untergrundmarkt für Exploits
In den vergangenen zwei Jahren haben wir den Untergrundmarkt für Exploits unter die Lupe genommen, um mehr über den Lebenszyklus von Exploits, die Kategorien von Käufern und Verkäufern und die Geschäftsmodelle im Untergrund zu erfahren.
By: Trend Micro Sep 07, 2021 Read time: ( words)
Save to Folio
Originalbeitrag von Trend Micro Research
In den vergangenen zwei Jahren haben wir den Untergrundmarkt für Exploits unter die Lupe genommen, um mehr über den Lebenszyklus von Exploits, die Kategorien von Käufern und Verkäufern und die Geschäftsmodelle im Untergrund zu erfahren. Die Ergebnisse sind in dem Whitepaper „The Rise and Imminent Fall of the N-Day Exploit Market in the Cybercriminal Underground“ zusammengefasst. So ze
Trendmicro
The Underground Exploit Market and the Importance of Virtual Patching
blogs_trendmicro·2021-07-13·CVSS 9.8
[CRITICAL] The Underground Exploit Market and the Importance of Virtual Patching
Exploits & Vulnerabilities
# The Underground Exploit Market and the Importance of Virtual Patching
Over the past two calendar years, we conducted research on the underground exploit market to learn more about the life cycle of exploits, the kinds of buyers and sellers who transact, and the business models that are in effect in the underground.
By: Trend Micro Research
2021/07/13
Read time: ( words)
Save to Folio
Over the past two calendar years, we conducted research on the underground exploit market to learn more about the life cycle of exploits, the kinds of buyers and sellers who transact, and the business models that are in effect in the underground. We detail our findings in our research paper “The Rise and Imminent Fall of the N-Day Exploit Market in the Cybercriminal Undergrou
Trendmicro
Smart doch angreifbar: Schwachstellen bei IoT-Geräten
blogs_trendmicro·2020-06-10
Smart doch angreifbar: Schwachstellen bei IoT-Geräten
Cyberbedrohungen
## Smart doch angreifbar: Schwachstellen bei IoT-Geräten
Die Vielfalt der Funktionen von smarten Geräten bietet großen Nutzen zu Hause, in Unternehmen und im öffentlichen Bereich. Doch gleichzeitig sind auch die Sicherheitsrisiken hoch, die sich durch Schwachstellen und Lücken darin ergeben.
By: Trend Micro Jun 10, 2020 Read time: ( words)
Save to Folio
von Trend Micro
Die Vielfalt der Funktionen von smarten Geräten bietet großen Nutzen für Umgebungen zu Hause, in Unternehmen und im öffentlichen Bereich, doch gleichzeitig sind auch die Sicherheitsrisiken hoch, die sich durch Schwachstellen und Lücken darin ergeben. Angreifbare smarte Geräte setzen die Netzwerke Angriffen aus. IoT-Geräte sind vor allem deshalb gefährdet, weil ihnen die notwendige eingebaute Sicherheit
Talos
Threat Source newsletter (April 2, 2020)
blogs_talos·2020-04-02
Threat Source newsletter (April 2, 2020)
## Threat Source newsletter (April 2, 2020)
Newsletter compiled by Jon Munshaw.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
As long as COVID-19 is in the headlines (which is going to be a long time) actors are going to try and capitalize. We fully expect to see a rise in spam that’s now related to the economic assistance package passed by the U.S. government.
In non-virus-related news, we also have a new overview of the Trickbot banking trojan. This family has been around for a while, but we’ve recently seen a spike in distribution related to the aforementioned COVID-19 campaigns. What does Trickbot look like? And what are some best practices to defend against it? We run through all that here .
And, as al
Talos
Threat Source newsletter (April 2, 2020)
blogs_talos·2020-04-02
Threat Source newsletter (April 2, 2020)
Newsletter compiled by Jon Munshaw.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
As long as COVID-19 is in the headlines (which is going to be a long time) actors are going to try and capitalize. We fully expect to see a rise in spam that’s now related to the economic assistance packagepassed by the U.S. government.
In non-virus-related news, we also have a new overview of the Trickbot banking trojan. This family has been around for a while, but we’ve recently seen a spike in distribution related to the aforementioned COVID-19 campaigns. What does Trickbot look like? And what are some best practices to defend against it? We run through all that here.
And, as always, we have the latest Threat Roundup where w
Krebs
Zyxel Flaw Powers New Mirai IoT Botnet Strain
blogs_krebs·2020-03-20·CVSS 9.8
[CRITICAL] Zyxel Flaw Powers New Mirai IoT Botnet Strain
In February, hardware maker Zyxel fixed a zero-day vulnerability in its routers and VPN firewall products after KrebsOnSecurity told the company the flaw was being abused by attackers to break into devices. This week, security researchers said they spotted that same vulnerability being exploited by a new variant of Mirai , a malware strain that targets vulnerable Internet of Things (IoT) devices for use in large-scale attacks and as proxies for other cybercrime activity .
Security experts at Palo Alto Networks said Thursday their sensors detected the new Mirai variant — dubbed Mukashi — on Mar. 12. The new Mirai strain targets CVE-2020-9054 , a critical flaw that exists in many VPN firewalls and network attached storage (NAS) devices made by Taiwanese vendor Zyxel Communication Corp. , wh
Krebs
Zyxel Flaw Powers New Mirai IoT Botnet Strain
blogs_krebs·2020-03-20·CVSS 9.8
[CRITICAL] Zyxel Flaw Powers New Mirai IoT Botnet Strain
In February, hardware maker Zyxel fixed a zero-day vulnerability in its routers and VPN firewall products after KrebsOnSecurity told the company the flaw was being abused by attackers to break into devices. This week, security researchers said they spotted that same vulnerability being exploited by a new variant of Mirai, a malware strain that targets vulnerable Internet of Things (IoT) devices for use in large-scale attacks and as proxies for other cybercrime activity.
Security experts at Palo Alto Networks said Thursday their sensors detected the new Mirai variant — dubbed Mukashi — on Mar. 12. The new Mirai strain targets CVE-2020-9054, a critical flaw that exists in many VPN firewalls and network attached storage (NAS) devices made by Taiwanese vendor Zyxel Communication Corp., which
Unit42
New Mirai Variant Targets Zyxel Network-Attached Storage Devices
blogs_unit42·2020-03-19·CVSS 9.8
CVE-2020-9054 [CRITICAL] New Mirai Variant Targets Zyxel Network-Attached Storage Devices
Threat Research Center
Threat Research
Malware
## New Mirai Variant Targets Zyxel Network-Attached Storage Devices
Ken Hsu
Zhibin Zhang
Ruchna Nigam
Published: March 19, 2020
Malware
Threat Research
Vulnerabilities
CVE-2020-9054
Mirai variant
## Executive Summary
As soon as the proof-of-concept (PoC) for CVE-2020-9054 was made publicly available last month, this vulnerability was promptly abused to infect vulnerable versions of Zyxel network-attached storage (NAS) devices with a new Mirai variant - Mukashi.
Mukashi brute forces the logins using different combinations of default credentials, while informing its command and control (C2) server of the successful login attempts. Multiple, if not all, Zyxel NAS products running firmware versions up to 5.21 are vulnerable to t
Unit42
New Mirai Variant Targets Zyxel Network-Attached Storage Devices
blogs_unit42·2020-03-19·CVSS 9.8
CVE-2020-9054 [CRITICAL] New Mirai Variant Targets Zyxel Network-Attached Storage Devices
## Executive Summary
As soon as the proof-of-concept (PoC) for CVE-2020-9054 was made publicly available last month, this vulnerability was promptly abused to infect vulnerable versions of Zyxel network-attached storage (NAS) devices with a new Mirai variant - Mukashi.
Mukashi brute forces the logins using different combinations of default credentials, while informing its command and control (C2) server of the successful login attempts. Multiple, if not all, Zyxel NAS products running firmware versions up to 5.21 are vulnerable to this pre-authentication command injection vulnerability. The vendor advisory is also available.
You can test to see if a Zyxel NAS device is vulnerable here.
This vulnerability has a critical rating (i.e CVSS v3.1 score of 9.8) due to its trivial-to-exploit n
Checkpoint
March 2nd – Threat Intelligence Bulletin
blogs_checkpoint·2020-03-02·CVSS 9.8
CVE-2019-19781 [CRITICAL] March 2nd – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## March 2nd – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of March 2nd 2020, please download our Threat Intelligence Bulletin
TOP ATTACKS AND BREA
Krebs
Zyxel Fixes 0day in Network Storage Devices
blogs_krebs·2020-02-24
Zyxel Fixes 0day in Network Storage Devices
#### Patch comes amid active exploitation by ransomware gangs
Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground.
Based in Taiwan, Zyxel Communications Corp. (a.k.a “ZyXEL”) is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Thin
Krebs
Zyxel Fixes 0day in Network Storage Devices
blogs_krebs·2020-02-24
Zyxel Fixes 0day in Network Storage Devices
## Patch comes amid active exploitation by ransomware gangs
Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground.
Based in Taiwan, Zyxel Communications Corp. (a.k.a “ZyXEL”) is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things
CWE
Improper Input Validation
mitre_cwe
CWE-20 Improper Input Validation
CWE-20: Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
Input validation is a frequently-used technique
for checking potentially dangerous inputs in order to
ensure that the inputs are safe for processing within the
code, or when communicating with other components. Input can consist of: raw data - strings, numbers, parameters, file contents, etc. metadata - information about the raw data, such as headers or size Data can be simple or structured. Structured data
can be composed of many nested layers, composed of
combinations of metadata and raw data, with other simple or
structured data. Many properties of raw data or metadata may n
CWE
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
mitre_cwe
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications. Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compro
CWE
Firmware Not Updateable
mitre_cwe
CWE-1277 Firmware Not Updateable
CWE-1277: Firmware Not Updateable
The product does not provide its
users with the ability to update or patch its
firmware to address any vulnerabilities or
weaknesses that may be present.
Without the ability to
patch or update firmware, consumers will be
left vulnerable to exploitation of any known
vulnerabilities, or any vulnerabilities that
are discovered in the future. This can expose
consumers to permanent risk throughout the
entire lifetime of the device, which could be
years or decades. Some external protective
measures and mitigations might be employed to
aid in preventing or reducing the risk of
malicious attack, but the root weakness cannot
be corrected.
Modes of Introduction:
Phase: Requirements
Note: Requirements development might not consider the importance of updates over t
CWE
Reliance on Component That is Not Updateable
mitre_cwe
CWE-1329 Reliance on Component That is Not Updateable
CWE-1329: Reliance on Component That is Not Updateable
The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs.
If the component is discovered to contain a vulnerability or critical bug, but the issue cannot be fixed using an update or patch, then the product's owner will not be able to protect against the issue. The only option might be replacement of the product, which could be too financially or operationally expensive for the product owner. As a result, the inability to patch or update can leave the product open to attacker exploitation or critical operation failures. This weakness can be especially difficult to manage when using ROM, firmware, or similar components that traditionally have had limited or no update capa
CWE
Improper Neutralization of Special Elements used in a Command ('Command Injection')
mitre_cwe
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
Modes of Introduction:
Phase: Implementation
Note: Command injection vulnerabilities typically occur when: Data enters the application from an untrusted source. The data is part of a string that is exe
CWE
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
mitre_cwe
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Modes of Introduction:
Phase: Implementation
Note: REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Common Consequences:
Scope: Confidentiality. Impact: Read Application Data. Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Scope: Access Cont
CWE
Reliance on Insufficiently Trustworthy Component
mitre_cwe
CWE-1357 Reliance on Insufficiently Trustworthy Component
CWE-1357: Reliance on Insufficiently Trustworthy Component
The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
Many modern hardware and software products are built by combining multiple smaller components together into one larger entity, often during the design or architecture phase. For example, a hardware component might be built by a separate supplier, or the product might use an open-source software library from a third party. Regardless of the source, each component should be sufficiently trusted to ensure correct, secure operation of the product. If a component is not trustworthy, it can produce significant risks for the overall product, s
https://cwe.mitre.org/data/definitions/78.htmlhttps://kb.cert.org/artifacts/cve-2020-9054.htmlhttps://kb.cert.org/vuls/id/498544/https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtmlhttps://cwe.mitre.org/data/definitions/78.htmlhttps://kb.cert.org/artifacts/cve-2020-9054.htmlhttps://kb.cert.org/vuls/id/498544/https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9054
2020-03-04
Published
2022-03-25
Added to CISA KEV
Exploited in the wild