Zyxel NAS326 (NAS326)

Zyxel NAS326 (NAS326)
Security Grade F Calculator v1	Zyxel NAS326 (NAS326) Brand: Zyxel Category: NAS • Model / Gen: NAS326 Release Date: 2016-01-01 • Status: End of sale Classification Date: 2026-10-26 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	—	Consumer NAS with removable drive bays; no tamper-resistant hardware.
Known vulnerabilities	Very common	—	CVE-2020-9054 (pre-authentication command injection in weblogin.cgi) plus several other CVEs. Source: nvd.nist.gov/vuln/detail/CVE-2020-9054
Prior attacks	Very common	—	CVE-2020-9054 is in CISA's KEV catalog and has been actively exploited; default credentials abused by botnets. Source: www.cisa.gov/known-exploited-vulnerabilities-catalog
Updatability	Rare	—	Firmware updates exist but the NAS326 platform is aging and updates are irregular. Source: www.cvedetails.com/vendor/859/Zyxel.html
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—	Admin and share access require credentials, but the pre-auth flaw bypasses authentication entirely. Source: nvd.nist.gov/vuln/detail/CVE-2020-9054
Communications	Encrypted with obselete encryption	—	Mixed encryption; legacy management and file protocols coexist with TLS.
Storage	No encryption	—	No full-disk encryption; stored data is unencrypted.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	—	Basic user/group management with limited roles.
Authentication	Basic	—	Username/password login with a history of default 'admin/1234' style credentials.
Brute-force protection	Absent	—	No effective login rate-limiting; vulnerable to brute-force and default-credential attacks.
Event logging	Partial logging	—	Partial event/access logging only.
Passwords	Default/Common/Easy to guess	—	Ships with well-known default credentials that many users never change. Source: www.cisa.gov/known-exploited-vulnerabilities-catalog
Category Score	Score: 3 / 3