8.8
HIGH
CVE-2020-13365
Zyxel NAS Remote Root Telnet Password Generation Vulnerability
Description

Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used for a TELNET session as root. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, and V5.11(AASZ.0)C0; NAS542 V5.11(ABAG.0)C0, V5.20(ABAG.1)C0, and V5.21(ABAG.3)C0; NSA325 v2_V4.81(AALS.0)C0 and V4.81(AAAJ.1)C0; NSA310 4.22(AFK.0)C0 and 4.22(AFK.1)C0; NAS326 V5.21(AAZF.8)C0, V5.11(AAZF.4)C0, V5.11(AAZF.2)C0, and V5.11(AAZF.3)C0; NSA310S V4.75(AALH.2)C0; NSA320S V4.75(AANV.2)C0 and V4.75(AANV.1)C0; NSA221 V4.41(AFM.1)C0; and NAS540 V5.21(AATB.5)C0 and V5.21(AATB.3)C0.

INFO

Published Date :

Aug. 6, 2020, 5:15 p.m.

Last Modified :

Feb. 9, 2022, 4:51 p.m.

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.8
Public PoC/Exploit Available at Github

CVE-2020-13365 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2020-13365 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Zyxel nas326_firmware
2 Zyxel nas540_firmware
3 Zyxel nas542_firmware
4 Zyxel nas520_firmware
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2020-13365.

URL Resource
https://www.zyxel.com/support/Zyxel-security-advisory-for-NAS-remote-access-vulnerability.shtml Vendor Advisory
https://www.zyxel.com/us/en/support/security_advisories.shtml Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Vulnerability research, firmware analysis, reverse engineering, programming notes (as much as I can)

reverse firmware linux iot programming vulnerability research exploitation

Updated: 1 year, 9 months ago
0 stars 0 fork 0 watcher
Born at : May 23, 2020, 3:11 p.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2020-13365 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2020-13365 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:h:zyzel:nas540:-:*:*:*:*:*:*:* OR *cpe:2.3:h:zyxel:nas540:-:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:h:zyzel:nas520:-:*:*:*:*:*:*:* OR *cpe:2.3:h:zyxel:nas520:-:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:h:zyzel:nas326:-:*:*:*:*:*:*:* OR *cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:zyzel:nas540_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(aatb.6)c0 OR *cpe:2.3:o:zyxel:nas540_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(aatb.6)c0
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:zyzel:nas520_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(aasz.5)c0 OR *cpe:2.3:o:zyxel:nas520_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(aasz.5)c0
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:zyzel:nas326_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(aazf.9)c0 OR *cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(aazf.9)c0
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:h:zyzel:nas542:-:*:*:*:*:*:*:* OR *cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Feb. 09, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:zyzel:nas542_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(abag.6)c0 OR *cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:* versions from (excluding) v5.21(abag.6)c0
  • CWE Remap by [email protected]

    Jul. 21, 2021

    Action Type Old Value New Value
    Changed CWE CWE-269 CWE-287
  • Initial Analysis by [email protected]

    Aug. 11, 2020

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:N/AC:L/Au:S/C:C/I:C/A:C)
    Added CVSS V3.1 NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://www.zyxel.com/support/Zyxel-security-advisory-for-NAS-remote-access-vulnerability.shtml No Types Assigned https://www.zyxel.com/support/Zyxel-security-advisory-for-NAS-remote-access-vulnerability.shtml Vendor Advisory
    Changed Reference Type https://www.zyxel.com/us/en/support/security_advisories.shtml No Types Assigned https://www.zyxel.com/us/en/support/security_advisories.shtml Vendor Advisory
    Added CWE NIST CWE-269
    Added CPE Configuration AND OR *cpe:2.3:o:zyzel:nas326_firmware:*:*:*:*:*:*:*:* versions up to (excluding) v5.21\(aazf.9\)c0 OR cpe:2.3:h:zyzel:nas326:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:zyzel:nas520_firmware:*:*:*:*:*:*:*:* versions up to (excluding) v5.21\(aasz.5\)c0 OR cpe:2.3:h:zyzel:nas520:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:zyzel:nas540_firmware:*:*:*:*:*:*:*:* versions up to (excluding) v5.21\(aatb.6\)c0 OR cpe:2.3:h:zyzel:nas540:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:zyzel:nas542_firmware:*:*:*:*:*:*:*:* versions up to (excluding) v5.21\(abag.6\)c0 OR cpe:2.3:h:zyzel:nas542:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2020-13365 is associated with the following CWEs:

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.10 }} 0.00%

score

0.40035

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability