Constellation · CASCA

Constellation explorer

Every signal has a story.Follow the evidence.

Return to triage

Find a CVE by identifier or text

↵ select

Minimum eligible CVSSOrderKEV only

Start with evidence

Current exploration

CVE-2020-9054

Your trail

Where next?

Selected cve

CVE-2020-9054

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arb

67 retained evidence references · snapshot-bound · open authoritative view

StateSource-scoped evidence

Priority84.5–97.5

Coverage85.0%

Connections67

Choose an action.

Evidence state

identity unresolved
known present
source constrained
evidence unknown

Snapshot-bound reason tuple

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Connections 67

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA310

bbe87894-df28-457b-990e-2eab866a1f9f

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA210

4553e39c-c44b-4884-a89d-c930590ca67b

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA325

9def8cc3-9251-468f-a015-b4139ac08fb7

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NAS542

7fd921e7-e588-4ead-b4ce-c7df972cd8ae

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA325v2

a61eb1e1-e9d7-4fbc-a147-b15bf743d971

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA221

0bcd5344-1fcc-4697-a0d0-4138ebcb316b

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA220

23b73a61-e7be-4d6f-b4e5-c9e6fd85684d

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NAS326

fbc4fcba-928d-4184-ac85-b1fab1c78dcc

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NAS540

96d076ef-7ea1-43c0-9cd9-3f0d334a9fa9

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA320

e74ea9fd-4e09-4647-a33f-ccfbae3461d1

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NAS520

990c04e0-a42e-46e9-8f7a-8dae9c0cf78d

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA220+

08e7a657-34e1-4c4f-abda-d45ddf1c2db0

has cited scope1 retained · stored CVE-2020-9054 → ZyXEL · NSA320S

b6573868-58d9-45c2-bfce-96afa28a55dc

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · zywall310

f52154da-0014-4379-86f3-af46addf8906

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg20-vpn

f3cfbc69-a023-4c13-b4c0-92cf7efcddca

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · vpn100

6a1805e7-7c17-4ddc-9ef8-363a33e7b712

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · atp100

6f25f016-810c-4519-b420-fdbce72af626

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · nas540

d57cfec3-28a7-4c12-a51b-229d662eb936

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg40

79ac81e9-d431-4695-82d6-40ca4bef541c

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · atp200

240fc324-fbfe-4887-b00d-40954e7ba36e

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg310

58489f73-e339-4070-b138-60fb10f6495d

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · atp500

6bc0d435-75ef-41c9-8302-034a0d720403

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · nas520

a194c6af-3e0f-409c-a319-53766e9c2ee1

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · atp800

c468aedd-c8f3-4b9e-9230-553888de90bf

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg210

d73fc6ea-5a4d-487c-b7d8-c8e3d9be0b0a

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg20w-vpn

62ad24e1-237a-41e9-a6c0-a3524cca375a

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg1100

e215d3f8-2630-41c6-aaeb-52c12c5361a2

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · vpn300

b263da99-4c17-4567-8e1d-3d5ed4be1351

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg60

e9578e4b-7f86-4634-bedb-fde0702d5528

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg2200

1d553a52-9bd5-48c6-a826-658919cc39a2

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg60w

5130f212-784f-4139-b5a3-6abe1867225b

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · nas542

b3cce06a-3a3e-4a04-9aaa-45db0a03f3e6

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · zywall110

2d39f650-50b5-4352-8b3a-86929e404435

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg110

cfaf3ac7-ee1a-458c-a43a-27663045e3bd

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg1900

b7904cae-cfff-4385-bb7d-8186ba295166

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · nas326

54dc96bf-6f62-4592-906c-e6f4623e8f54

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · zywall1100

0be24a4d-f7f9-4aee-b730-9ce8e176907a

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · vpn1000

3a7134ed-dc4e-4120-b643-35aa575f9222

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · vpn50

29d037c5-9107-42ab-9531-bd760f0c4699

has environmental constraint1 retained · stored CVE-2020-9054 → zyxel · usg40w

e033c930-fa15-4d0a-8ed6-31309d2d34e4

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg60w_firmware

8942e89f-1ba3-434a-aa67-6cb57a78f99d

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg310_firmware

e64bfdf5-ca3f-460e-9aeb-8327b6a94ac3

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · vpn1000_firmware

1428a3e5-d0b4-4745-b091-2bc7e2b1fcd4

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · zywall110_firmware

2f33aaa2-e0fa-45c0-b285-630a9c972be8

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · zywall310_firmware

7aab20f1-6038-4c2e-8aae-506e09c7fc82

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg110_firmware

b571e8e1-6679-4b0e-852a-77247af1fb3b

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · atp500_firmware

926895f9-0def-4ba2-b71f-3b4ca2614e72

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · vpn100_firmware

5e081930-39f5-40da-9aa7-9068a9d277ad

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · vpn300_firmware

98258da7-53a5-443a-b41f-2ce97bd500e3

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg60_firmware

8bc1a199-2707-41ea-83b2-52034ea3e863

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg210_firmware

4457fc26-a741-4db6-bf6d-1b299bab21a7

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg40_firmware

56b14513-b119-4f95-85cf-ff6205f78e08

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · atp100_firmware

48c081c6-40bd-415f-b7a3-bff3c63f29c1

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg1100_firmware

979d341a-5116-4a4c-8d74-d0c7c12415e0

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg40w_firmware

9c537a65-e1a1-4568-9a07-98ba3e8478f7

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · atp800_firmware

2922cb79-3be4-458c-ba3d-c341befbf98d

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · nas326_firmware

1117a461-f539-429c-984c-3746a2814928

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg2200_firmware

e26125ec-c1ee-4240-a64b-7a38ca63f610

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg1900_firmware

c000a803-f2fd-4e4c-84ff-f84431ea6b1a

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · atp200_firmware

d4d06cce-71c3-4c56-b881-fd4c2a3a73f5

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · vpn50_firmware

4fea565a-cb78-4e9f-b4f1-8f30bccb0974

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · nas540_firmware

fb5a8030-2cde-4cdb-9546-7d7540bdba0c

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg20-vpn_firmware

f95262c4-bd80-4a2b-8397-5d5bc350c404

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · nas520_firmware

0bda8b33-eeeb-4fee-8361-faa8c1db5115

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · nas542_firmware

576d061b-71da-4982-84f7-446220594d70

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · usg20w-vpn_firmware

50ec0b3c-1f6a-4533-81d8-013d59d982fa

has vulnerable target scope1 retained · stored CVE-2020-9054 → zyxel · zywall1100_firmware

1951eff6-3064-42af-8629-009c69f9eab0

Focused snapshot evidence neighborhood.

CVEProductSignalSelected / traceVisual proximity carries zero evidence weight.

Data as of

Evidence current through Oct 22, 2026, 6:07 PM UTC · 68 entities · 67 relationships · bounded complete