Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
- Vendor
- Zyxel
- Product
- Multiple Network-Attached Storage (NAS) Devices
- CVSS
- 9.8
- EPSS (exploit probability)
- 100.0%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Added to KEV
Is CVE-2020-9054 being exploited?
Yes. CISA added CVE-2020-9054 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 100.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
What to do
CISA required actionApply updates per vendor instructions.
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Other Zyxel CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflowwrite-up | [ HIGH ] | 8.8 | 2.5% | |
| CVE-2024-40891 Zyxel DSL CPE OS Command Injection Vulnerability | [ HIGH ] | 8.8 | 22.9% | |
| CVE-2024-40890 Zyxel DSL CPE OS Command Injection Vulnerability | [ HIGH ] | 8.8 | 20.7% | |
| CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerabilityransomware use | [ HIGH ] | 7.5 | 2.9% | |
| CVE-2017-6884 Zyxel EMG2926 Routers Command Injection Vulnerabilityransomware use | [ HIGH ] | 8.8 | 33.0% | |
| CVE-2017-18368 Zyxel P660HN-T1A Routers Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 94.5% | |
| CVE-2023-27992 Zyxel Multiple NAS Devices Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 82.8% | |
| CVE-2023-33010 Zyxel Multiple Firewalls Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 29.0% |