Zyxel vulnerabilities in CISA KEV
Zyxel has 13 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 22nd highest of any vendor. 1 was added in the last 12 months; 2 are linked to known ransomware use (15.4% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Multiple Firewalls, with 5 entries. Other frequently affected products: DSL CPE Devices (2); Multiple Network-Attached Storage (NAS) Devices (2).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor zyxel --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
13
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-09-21
most recent entry
┌─ last 12 months
1
entries added
┌─ ransomware use
2 of 13
15.4% linked to ransomware
┌─ distinct products
7
affected products
$ awk -F, {print $1} /var/log/kev/zyxel.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 1 | 0 |
| 2022 | 2 | 0 |
| 2023 | 6 | 1 |
| 2024 | 1 | 1 |
| 2025 | 2 | 0 |
| 2026 | 1 | 0 |
$ sort /var/log/kev/zyxel.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Multiple Firewalls 5 entries
- DSL CPE Devices 2 entries
- Multiple Network-Attached Storage (NAS) Devices 2 entries
- EMG2926 Routers 1 entry
- GS1900 Series Switches 1 entry
$ kev-due-dates --vendor zyxel
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Zyxel
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/zyxel.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (13 of 13 have at least one CWE).
$ grep -ril 'Zyxel' /var/log/news | head -5
Our reporting that names Zyxel or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./zyxel.kev · 13 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-7273
GS1900 Series Switches
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
due 2026-09-24 · CWE-121
$ cat CVE-2026-7273.txt
Description. Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2024-40890
DSL CPE Devices
Zyxel DSL CPE OS Command Injection Vulnerability
due 2025-03-04 · CWE-78
$ cat CVE-2024-40890.txt
Description. Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
Required action. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- CVE-2024-40891
DSL CPE Devices
Zyxel DSL CPE OS Command Injection Vulnerability
due 2025-03-04 · CWE-78
$ cat CVE-2024-40891.txt
Description. Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
Required action. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- CVE-2024-11667
Multiple Firewalls [RANSOMWARE]
Zyxel Multiple Firewalls Path Traversal Vulnerability
due 2024-12-24 · CWE-22
$ cat CVE-2024-11667.txt
Description. Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2017-6884
EMG2926 Routers [RANSOMWARE]
Zyxel EMG2926 Routers Command Injection Vulnerability
due 2023-10-09 · CWE-78
$ cat CVE-2017-6884.txt
Description. Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2017-18368
P660HN-T1A Routers
Zyxel P660HN-T1A Routers Command Injection Vulnerability
due 2023-08-28 · CWE-78
$ cat CVE-2017-18368.txt
Description. Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-27992
Multiple Network-Attached Storage (NAS) Devices
Zyxel Multiple NAS Devices Command Injection Vulnerability
due 2023-07-14 · CWE-78
$ cat CVE-2023-27992.txt
Description. Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Required action. Apply updates per vendor instructions.
- CVE-2023-33009
Multiple Firewalls
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
due 2023-06-26 · CWE-120
$ cat CVE-2023-33009.txt
Description. Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
Required action. Apply updates per vendor instructions.
- CVE-2023-33010
Multiple Firewalls
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
due 2023-06-26 · CWE-120
$ cat CVE-2023-33010.txt
Description. Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
Required action. Apply updates per vendor instructions.
- CVE-2023-28771
Multiple Firewalls
Zyxel Multiple Firewalls OS Command Injection Vulnerability
due 2023-06-21 · CWE-78
$ cat CVE-2023-28771.txt
Description. Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
Required action. Apply updates per vendor instructions.
- CVE-2022-30525
Multiple Firewalls
Zyxel Multiple Firewalls OS Command Injection Vulnerability
due 2022-06-06 · CWE-78
$ cat CVE-2022-30525.txt
Description. A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Required action. Apply updates per vendor instructions.
- CVE-2020-9054
Multiple Network-Attached Storage (NAS) Devices
Zyxel Multiple NAS Devices OS Command Injection Vulnerability
due 2022-04-15 · CWE-78
$ cat CVE-2020-9054.txt
Description. Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Required action. Apply updates per vendor instructions.
- CVE-2020-29583
Multiple Products
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
due 2022-05-03 · CWE-522
$ cat CVE-2020-29583.txt
Description. Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
Required action. Apply updates per vendor instructions.