ZeusQA
Start free

Known exploited vulnerabilities

Zyxel vulnerabilities attackers have used

Every Zyxel vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 13 Zyxel vulnerabilities as exploited in the wild, 1 of them added in the last 12 months and 2 used in ransomware campaigns. The most recent is CVE-2026-7273, added Sep 21, 2026. Multiple Firewalls has the most entries (5).

In KEV, all time
13
Added, last 12 months
1
Used in ransomware
2
New CVEs this week
0

By product

Multiple Firewalls (5), DSL CPE Devices (2), Multiple Network-Attached Storage (NAS) Devices (2), EMG2926 Routers (1), GS1900 Series Switches (1), Multiple Products (1), P660HN-T1A Routers (1).

Every Zyxel entry in CISA KEV

  1. CVE-2026-7273

    Added · due

    Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

    Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

  2. CVE-2024-40891

    Added · due

    Zyxel DSL CPE OS Command Injection Vulnerability

    Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.

  3. CVE-2024-40890

    Added · due

    Zyxel DSL CPE OS Command Injection Vulnerability

    Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.

  4. CVE-2024-11667

    RansomwareAdded · due

    Zyxel Multiple Firewalls Path Traversal Vulnerability

    Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.

  5. CVE-2017-6884

    RansomwareAdded · due

    Zyxel EMG2926 Routers Command Injection Vulnerability

    Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the…

  6. CVE-2017-18368

    Added · due

    Zyxel P660HN-T1A Routers Command Injection Vulnerability

    Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.

  7. CVE-2023-27992

    Added · due

    Zyxel Multiple NAS Devices Command Injection Vulnerability

    Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.

  8. CVE-2023-33010

    Added · due

    Zyxel Multiple Firewalls Buffer Overflow Vulnerability

    Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions…

  9. CVE-2023-33009

    Added · due

    Zyxel Multiple Firewalls Buffer Overflow Vulnerability

    Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions…

  10. CVE-2023-28771

    Added · due

    Zyxel Multiple Firewalls OS Command Injection Vulnerability

    Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.

  11. CVE-2022-30525

    Added · due

    Zyxel Multiple Firewalls OS Command Injection Vulnerability

    A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

  12. CVE-2020-9054

    Added · due

    Zyxel Multiple NAS Devices OS Command Injection Vulnerability

    Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.

  13. CVE-2020-29583

    Added · due

    Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

    Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works