Vulnerabilities by vendor · updated on every deploy
Zyxel vulnerabilities: exploited CVEs and our analysis
Zyxel has 13 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 1 of them added in the last 12 months and 2 known to be used in ransomware campaigns. Below: the analysis Zero Hunt Research published on Zyxel products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
13
CVEs in CISA KEV
1
Added in the last 12 months
2
Known ransomware use
1
Zero Hunt analyses
Products with the most KEV entries: Multiple Firewalls (5) · DSL CPE Devices (2) · Multiple Network-Attached Storage (NAS) Devices (2) · EMG2926 Routers (1) · GS1900 Series Switches (1) · Multiple Products (1)
Our analysis of Zyxel vulnerabilities
2026-09-22
Zyxel GS1900 CVE-2026-7273: Unauthenticated RCE, Now Exploited in the WildZyxel GS1900 switch flaw CVE-2026-7273 lets a LAN-adjacent, unauthenticated attacker run OS commands with one HTTP request. Patched in June, added to CISA KEV in September.
All 13 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-09-21 | CVE-2026-7273 | GS1900 Series Switches Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a… | 2026-09-24 | Forensic triage | Read → |
| 2025-02-11 | CVE-2024-40891 | DSL CPE Devices Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. | 2025-03-04 | — | |
| 2025-02-11 | CVE-2024-40890 | DSL CPE Devices Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. | 2025-03-04 | — | |
| 2024-12-03 | CVE-2024-11667 | Multiple Firewalls Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. | 2024-12-24 | Ransomware | — |
| 2023-09-18 | CVE-2017-6884 | EMG2926 Routers Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the r… | 2023-10-09 | Ransomware | — |
| 2023-08-07 | CVE-2017-18368 | P660HN-T1A Routers Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLo… | 2023-08-28 | — | |
| 2023-06-23 | CVE-2023-27992 | Multiple Network-Attached Storage (NAS) Devices Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request. | 2023-07-14 | — | |
| 2023-06-05 | CVE-2023-33010 | Multiple Firewalls Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-se… | 2023-06-26 | — | |
| 2023-06-05 | CVE-2023-33009 | Multiple Firewalls Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-ser… | 2023-06-26 | — | |
| 2023-05-31 | CVE-2023-28771 | Multiple Firewalls Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. | 2023-06-21 | — | |
| 2022-05-16 | CVE-2022-30525 | Multiple Firewalls A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. | 2022-06-06 | — | |
| 2022-03-25 | CVE-2020-9054 | Multiple Network-Attached Storage (NAS) Devices Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code. | 2022-04-15 | — | |
| 2021-11-03 | CVE-2020-29583 | Multiple Products Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password. | 2022-05-03 | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Zyxel vulnerabilities are in the CISA KEV catalog?
13 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-09-21. 1 were added in the last 12 months.
Which Zyxel products have the most exploited vulnerabilities?
By KEV entries: Multiple Firewalls (5), DSL CPE Devices (2), Multiple Network-Attached Storage (NAS) Devices (2), EMG2926 Routers (1), GS1900 Series Switches (1), Multiple Products (1).
Are Zyxel vulnerabilities used in ransomware attacks?
CISA marks 2 of the 13 Zyxel entries as known to be used in ransomware campaigns. The table flags them.
Is the next Zyxel CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Progress · F5