CVE:CVE-2020-9054
CNNVD:CNNVD-202002-1216
Zyxel NAS520是中国合勤（Zyxel）公司的一款NAS（网络附加存储）设备。
多款ZyXEL产品存在操作系统命令注入漏洞。远程攻击者可借助特制的HTTP POST或GET请求利用该漏洞执行任意代码。以下产品及版本受到影响：使用V5.21(AAZF.7)C0之前版本固件的NAS326；使用V5.21(AASZ.3)C0之前版本固件的NAS520；使用V5.21(AATB.4)C0之前版本固件的NAS540；使用V5.21(ABAG.4)C0之前版本固件的NAS542；ZyXEL NSA210；ZyXEL NSA220；ZyXEL NSA220+；ZyXEL NSA221；ZyXEL NSA310；ZyXEL NSA310S；ZyXEL NSA320；ZyXEL NSA320S；ZyXEL NSA325；ZyXEL NSA325v2。
solution:Upgrade zyxel nas326_firmware to a higher version than 5.21\(aazf.7\c0,and avoid the version (,5.21\(aazf.7\)c0); Upgrade zyxel nas520_firmware to a higher version than 5.21\(aasz.3\c0,and avoid the version (,5.21\(aasz.3\)c0); Upgrade zyxel nas540_firmware to a higher version than 5.21\(aatb.4\c0,and avoid the version (,5.21\(aatb.4\)c0); Upgrade zyxel nas542_firmware to a higher version than 5.21\(abag.4\c0,and avoid the version (,5.21\(abag.4\)c0); Upgrade zyxel atp100_firmware to a higher version than 4.35\(abps.3\c0,and avoid the version [4.35,4.35\(abps.3\)c0); Upgrade zyxel atp200_firmware to a higher version than 4.35\(abfw.3\c0,and avoid the version [4.35,4.35\(abfw.3\)c0); Upgrade zyxel atp500_firmware to a higher version than 4.35\(abfu.3\c0,and avoid the version [4.35,4.35\(abfu.3\)c0); Upgrade zyxel atp800_firmware to a higher version than 4.35\(abiq.3\c0,and avoid the version [4.35,4.35\(abiq.3\)c0); Upgrade zyxel usg20-vpn_firmware to a higher version than 4.35\(abaq.3\c0,and avoid the version [4.35,4.35\(abaq.3\)c0); Upgrade zyxel usg20w-vpn_firmware to a higher version than 4.35\(abar.3\c0,and avoid the version [4.35,4.35\(abar.3\)c0); Upgrade zyxel usg40_firmware to a higher version than 4.35\(aala.3\c0,and avoid the version [4.35,4.35\(aala.3\)c0); Upgrade zyxel usg40w_firmware to a higher version than 4.35\(aalb.3\c0,and avoid the version [4.35,4.35\(aalb.3\)c0); Upgrade zyxel usg60_firmware to a higher version than 4.35\(aaky.3\c0,and avoid the version [4.35,4.35\(aaky.3\)c0); Upgrade zyxel usg60w_firmware to a higher version than 4.35\(aakz.3\c0,and avoid the version [4.35,4.35\(aakz.3\)c0); Upgrade zyxel usg110_firmware to a higher version than 4.35\(aaph.3\c0,and avoid the version [4.35,4.35\(aaph.3\)c0); Upgrade zyxel usg210_firmware to a higher version than 4.35\(aapi.3\c0,and avoid the version [4.35,4.35\(aapi.3\)c0); Upgrade zyxel usg310_firmware to a higher version than 4.35\(aapj.3\c0,and avoid the version [4.35,4.35\(aapj.3\)c0); Upgrade zyxel usg1100_firmware to a higher version than 4.35\(aapk.3\c0,and avoid the version [4.35,4.35\(aapk.3\)c0); Upgrade zyxel usg1900_firmware to a higher version than 4.35\(aapl.3\c0,and avoid the version [4.35,4.35\(aapl.3\)c0); Upgrade zyxel usg2200_firmware to a higher version than 4.35\(abae.3\c0,and avoid the version [4.35,4.35\(abae.3\)c0); Upgrade zyxel vpn50_firmware to a higher version than 4.35\(abhl.3\c0,and avoid the version [4.35,4.35\(abhl.3\)c0); Upgrade zyxel vpn100_firmware to a higher version than 4.35\(abfv.3\c0,and avoid the version [4.35,4.35\(abfv.3\)c0); Upgrade zyxel vpn300_firmware to a higher version than 4.35\(abfc.3\c0,and avoid the version [4.35,4.35\(abfc.3\)c0); Upgrade zyxel vpn1000_firmware to a higher version than 4.35\(abip.3\c0,and avoid the version [4.35,4.35\(abip.3\)c0); Upgrade zyxel zywall110_firmware to a higher version than 4.35\(aaaa.3\c0,and avoid the version [4.35,4.35\(aaaa.3\)c0); Upgrade zyxel zywall310_firmware to a higher version than 4.35\(aaab.3\c0,and avoid the version [4.35,4.35\(aaab.3\)c0); Upgrade zyxel zywall1100_firmware to a higher version than 4.35\(aaac.3\c0,and avoid the version [4.35,4.35\(aaac.3\)c0)