{"meta":{"title":"KEV entries: Zyxel","description":"All KEV entries for vendor Zyxel.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":13,"vendor":"Zyxel","entries":13,"shareOfCatalogPercent":0.8,"ransomwareKnown":2,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-09-21","rank":22},"data":[{"cveID":"CVE-2026-7273","vendorProject":"Zyxel","product":"GS1900 Series Switches","vulnerabilityName":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","dateAdded":"2026-09-21","dueDate":"2026-09-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-121"],"shortDescription":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-7273","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-7273/"},{"cveID":"CVE-2024-40891","vendorProject":"Zyxel","product":"DSL CPE Devices","vulnerabilityName":"Zyxel DSL CPE OS Command Injection Vulnerability","dateAdded":"2025-02-11","dueDate":"2025-03-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.","requiredAction":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40891","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-40891"},{"cveID":"CVE-2024-40890","vendorProject":"Zyxel","product":"DSL CPE Devices","vulnerabilityName":"Zyxel DSL CPE OS Command Injection Vulnerability","dateAdded":"2025-02-11","dueDate":"2025-03-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.","requiredAction":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40890","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-40890"},{"cveID":"CVE-2024-11667","vendorProject":"Zyxel","product":"Multiple Firewalls","vulnerabilityName":"Zyxel Multiple Firewalls Path Traversal Vulnerability","dateAdded":"2024-12-03","dueDate":"2024-12-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11667","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-11667"},{"cveID":"CVE-2017-6884","vendorProject":"Zyxel","product":"EMG2926 Routers","vulnerabilityName":"Zyxel EMG2926 Routers Command Injection Vulnerability","dateAdded":"2023-09-18","dueDate":"2023-10-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe, https://www.zyxelguard.com/Zyxel-EOL.asp; https://nvd.nist.gov/vuln/detail/CVE-2017-6884","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2017-6884"},{"cveID":"CVE-2017-18368","vendorProject":"Zyxel","product":"P660HN-T1A Routers","vulnerabilityName":"Zyxel P660HN-T1A Routers Command Injection Vulnerability","dateAdded":"2023-08-07","dueDate":"2023-08-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE-2017-18368","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2017-18368"},{"cveID":"CVE-2023-27992","vendorProject":"Zyxel","product":"Multiple Network-Attached Storage (NAS) Devices","vulnerabilityName":"Zyxel Multiple NAS Devices Command Injection Vulnerability","dateAdded":"2023-06-23","dueDate":"2023-07-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products;  https://nvd.nist.gov/vuln/detail/CVE-2023-27992","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-27992"},{"cveID":"CVE-2023-33010","vendorProject":"Zyxel","product":"Multiple Firewalls","vulnerabilityName":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","dateAdded":"2023-06-05","dueDate":"2023-06-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-120"],"shortDescription":"Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls;  https://nvd.nist.gov/vuln/detail/CVE-2023-33010","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-33010"},{"cveID":"CVE-2023-33009","vendorProject":"Zyxel","product":"Multiple Firewalls","vulnerabilityName":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","dateAdded":"2023-06-05","dueDate":"2023-06-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-120"],"shortDescription":"Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls;  https://nvd.nist.gov/vuln/detail/CVE-2023-33009","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-33009"},{"cveID":"CVE-2023-28771","vendorProject":"Zyxel","product":"Multiple Firewalls","vulnerabilityName":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","dateAdded":"2023-05-31","dueDate":"2023-06-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls;   https://nvd.nist.gov/vuln/detail/CVE-2023-28771","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-28771"},{"cveID":"CVE-2022-30525","vendorProject":"Zyxel","product":"Multiple Firewalls","vulnerabilityName":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","dateAdded":"2022-05-16","dueDate":"2022-06-06","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-30525","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-30525"},{"cveID":"CVE-2020-9054","vendorProject":"Zyxel","product":"Multiple Network-Attached Storage (NAS) Devices","vulnerabilityName":"Zyxel Multiple NAS Devices OS Command Injection Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-9054","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-9054"},{"cveID":"CVE-2020-29583","vendorProject":"Zyxel","product":"Multiple Products","vulnerabilityName":"Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-522"],"shortDescription":"Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account (\"zyfwp\") with an unchangeable password.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-29583","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-29583"}]}