Is CVE-2020-9054 (Zyxel Multiple NAS Devices OS Command Injection) being exploited in the wild?

Yes. CISA added CVE-2020-9054 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.

What “being exploited in the wild” means for this CVE

CISA’s KEV catalogue is a practical signal, not just a documentation list. For CISA Known Exploited Vulnerabilities Catalog, inclusion means CISA has enough evidence to treat the issue as actively abused, so defenders should assume real-world attacker interest rather than a theoretical flaw. For confirmation and product detail, use the vendor advisory and the NIST National Vulnerability Database.

For this issue, the practical implication is that internet-exposed NAS appliances should be treated as high-priority assets, especially when management interfaces are reachable from untrusted networks. A pre-authentication command injection flaw is not a narrow edge case, because it can turn an exposed appliance into a remote execution foothold without valid credentials.

Why command injection on NAS devices is operationally dangerous

NAS devices are usually trusted as shared infrastructure, which makes them attractive for attackers seeking persistence, file access, or a staging point inside the network. Zyxel NAS exposure is especially concerning because the flaw is pre-authentication, so compromise can start before any normal login, MFA, or account protection applies. The attack surface is therefore the device itself, not just its user accounts.

That matters because file-serving appliances often hold backups, shared documents, and configuration data. Once an attacker gains code execution on the appliance, they may be able to read data, plant malware, alter files, or use the device to pivot deeper into the environment. Even if the immediate impact is limited to one box, the downstream effect can be much broader than the device’s role suggests.

How to confirm exposure and respond without waiting for perfect certainty

Start by inventorying every Zyxel NAS instance, including units that are no longer actively managed but remain powered on. If the device is reachable from the internet, has an exposed management path, or is used as a shared storage target, treat it as exposed until proven otherwise. The relevant question is not whether the device seems obscure, but whether it is reachable and still within its service life.

Where patching or replacement is delayed, reduce exposure first by removing public reachability, segmenting the device, and restricting administrative access to trusted management paths only. If the appliance must remain in service briefly, preserve logs, capture the current configuration, and verify whether any accounts, keys, or stored credentials were accessible on the device. For broader prioritisation and validation workflows, see the Vulnerability Management Guide and the Zero-Day and Exploited Vulnerabilities Guide.

Risk and Threat Considerations

Active exploitation changes the response threshold. When a flaw is in KEV, the main risk is no longer just future compromise, but that the device may already be targeted, scanned, or abused by opportunistic attackers. Command injection on an appliance also creates a strong possibility of silent compromise, because the attacker may only need brief execution to place a backdoor, exfiltrate data, or disable visibility.

Failure mechanism: A remotely reachable NAS interface accepts crafted input that the device executes as operating-system commands, bypassing normal authentication controls and giving an attacker direct execution on the appliance.

Impact: The device can become a foothold for data theft, tampering, persistence, or lateral movement, and in environments that store backups or shared files, the blast radius can extend beyond the appliance itself.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited NAS flaws need prioritised vulnerability handling and exposure tracking.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	Internet-facing NAS appliances need hardened management exposure and restrictive configuration.
Recommendation — Prioritise and remediate the exposed NAS immediately using continuous vulnerability management. Harden NAS management exposure and disable unnecessary public interfaces.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation makes rapid flaw remediation essential for the affected appliance.
	CM-7 — Least Functionality	Reducing exposed services and interface reachability limits command-injection attack paths.
	IR-4 — Incident Handling	KEV-listed exploitation requires compromise assessment and response readiness.
Recommendation — Remediate the vulnerable NAS promptly and verify the fix. Remove unnecessary services and management exposure from the NAS. Investigate the appliance for signs of compromise and contain it if abuse is suspected.

Practitioner Guidance

What to verify: Confirm whether the NAS is internet reachable, whether it is still supported by the vendor, and whether its logs and file stores show signs of unusual access, new binaries, configuration changes, or unexpected outbound connections. If you cannot verify integrity quickly, assume the device may have been touched.

Decision rule: If the appliance is exposed and you cannot patch it immediately, isolate it before you spend time on root-cause analysis. If it contains backup data or privileged file shares, prioritise compromise assessment and credential review alongside containment, because those stores can outlive the initial exploit.

What practitioners underestimate: NAS compromise is often treated as a maintenance problem, but it is frequently a trust problem. A storage appliance that can execute commands is not just a file server anymore, it is a host with network reach and a potential persistence layer.

Practitioner takeaway: For KEV-listed command injection on a storage appliance, containment and exposure reduction come first, because the business risk is shaped by what the device can reach and what sensitive data it already holds.