Loading story…
Zyxel warned that CVE-2020-9054 is a critical pre-authentication remote code execution flaw in the weblogin.cgi component of certain NAS and firewall products, caused by missing authentication that enables OS command injection. The company said affected systems include NAS devices running firmware 5.21 and earlier and several UTM, ATP, and VPN firewall releases on ZLD V4.35 Patch 0 through Patch 2, and urged customers to install firmware updates immediately or apply workarounds for unsupported devices. Zyxel later reiterated the risk after noting that BotenaGo malware was targeting devices with known CVEs, advising organizations to patch or isolate internet-exposed systems.
Palo Alto Networks' Unit 42 reported that a public proof of concept for CVE-2020-9054 was quickly weaponized to compromise vulnerable Zyxel NAS devices and install a Mirai variant dubbed Mukashi. Researchers observed exploitation in the wild beginning March 12, 2020, with attackers using a shell script to fetch architecture-specific bot binaries, erase traces, and enroll devices into a botnet that scans TCP port 23, brute-forces default credentials, and supports multiple DDoS commands. Unit 42 said the malware communicated with 45[.]84[.]196[.]75 over TCP ports 34834 and 4864, while also binding locally to TCP port 23448 to prevent multiple infections on the same host.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Zyxel updated patch firmware versions for NAS326, NAS540, and NAS542 and added guidance related to BotenaGo malware. The revision refreshed remediation details for affected NAS customers.
Zyxel updated the advisory in response to research showing BotenaGo malware targeting devices with known CVEs from multiple vendors. The company again urged users to install applicable updates or isolate unsupported devices.
Palo Alto Networks observed exploitation of CVE-2020-9054 in the wild beginning at 19:07 UTC, with attackers downloading a shell script to infected Zyxel NAS devices that fetched and executed Mirai-variant binaries. The campaign used the flaw to install the new Mukashi malware.
Zyxel updated the advisory again to add a NAS firmware update FAQ. The change provided additional guidance to customers applying fixes for CVE-2020-9054.
Zyxel revised the advisory to update standard firmware download links for NAS products and removed hotfixes. This reflected a packaging change in how fixes were provided to customers.
Zyxel updated its advisory to add affected firewall products to the vulnerable product list and corrected the acknowledgment section. The update expanded the scope beyond NAS devices to include UTM, ATP, and VPN firewall lines.
Zyxel initially released a security advisory for CVE-2020-9054, a remote code execution flaw in weblogin.cgi affecting certain NAS products, and urged customers to install firmware updates or apply mitigations. CERT/CC coordinated the disclosure and Brian Krebs was credited with reporting the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
zyxel.com
Open sourcecve.mitre.org
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and defenders warned that two critical zero-day vulnerabilities in Zyxel CPE devices, `CVE-2024-40890` and `CVE-2024-40891`, are being actively exploited in the wild. The flaws affect Zyxel CPE models that are now end-of-life and can enable command injection leading to full device compromise; reporting from GreyNoise highlighted active exploitation of `CVE-2024-40891`, while CSIRT.SK said Mirai-based botnet variants have been observed abusing the issue. The exposed devices appear to be attractive initial-access targets because they sit at the network edge and can be conscripted into botnets or used as footholds into victim environments. Zyxel is not expected to issue patches for the affected hardware, leaving organizations to mitigate by replacing vulnerable devices, restricting access to administrative interfaces, and increasing monitoring of HTTP and Telnet traffic for signs of exploitation and post-compromise activity.
Jul 24, 2026
A Mirai variant rapidly spread by targeting **ZyXEL PK5001Z** routers affected by `CVE-2016-10401`, a backdoor account flaw that exposed hardcoded Telnet credentials and a hidden path to root access. After proof-of-concept exploit code was published, attackers began scanning ports `23` and `2323` at scale, logging in with credentials including `admin/CenturyL1nk` and `admin/QwestM0dem`, then using the device's built-in super-user capability to install Mirai malware on vulnerable internet-exposed routers. Researchers reported nearly **100,000 unique scanning IPs** over roughly 60 hours, with a large share of activity traced to Argentina, particularly networks associated with Telefonica de Argentina. Netlab linked the campaign to command-and-control servers at `bigboatreps.pw:23` and `blacklister.nl:23`, and said the malware was distributed in multiple CPU-specific builds before both servers were later sinkholed by the security community. The vulnerable modem version cited in public exploit material was **PK5001Z 2.6.20.19**, a model used by CenturyLink.
Aug 15, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026