Zyxel Vulnerabilities
Zyxel Networks sells firewalls, switches, wireless and broadband access equipment, and KEV also lists some of its NAS devices and DSL CPE. The database tracks 13 Zyxel CVE records. CISA lists 13 of them as exploited in the wild, most recently on 2026-09-21. The most affected products are Multiple Firewalls, DSL CPE Devices, Multiple Network-Attached Storage (NAS) Devices.
Recently Exploited Zyxel CVEs
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Zyxel DSL CPE OS Command Injection Vulnerability
Zyxel DSL CPE OS Command Injection Vulnerability
Zyxel Multiple Firewalls Path Traversal Vulnerability
Zyxel EMG2926 Routers Command Injection Vulnerability
Zyxel P660HN-T1A Routers Command Injection Vulnerability
Affected Products
7 products| Product | CVEs | KEV | Latest |
|---|---|---|---|
| Multiple Firewalls | 5 | 5 | 2024-12-03 |
| DSL CPE Devices | 2 | 2 | 2025-02-11 |
| Multiple Network-Attached Storage (NAS) Devices | 2 | 2 | 2023-06-23 |
| EMG2926 Routers | 1 | 1 | 2023-09-18 |
| GS1900 Series Switches | 1 | 1 | 2026-09-21 |
| Multiple Products | 1 | 1 | 2021-11-03 |
| P660HN-T1A Routers | 1 | 1 | 2023-08-07 |
All Zyxel CVEs
13 records| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | Zyxel | 8.8 | 2.5% | KEV | 2026-06-16 |
| CVE-2024-40891 | Zyxel DSL CPE OS Command Injection Vulnerability | Zyxel | 8.8 | 21.7% | KEV | 2025-02-04 |
| CVE-2024-40890 | Zyxel DSL CPE OS Command Injection Vulnerability | Zyxel | 8.8 | 20.7% | KEV | 2025-02-04 |
| CVE-2024-11667 | Zyxel Multiple Firewalls Path Traversal Vulnerability | Zyxel | 7.5 | 2.9% | KEV | 2024-11-27 |
| CVE-2017-6884 | Zyxel EMG2926 Routers Command Injection Vulnerability | - | 8.8 | 34.6% | KEV | 2017-04-06 |
| CVE-2017-18368 | Zyxel P660HN-T1A Routers Command Injection Vulnerability | - | 9.8 | 94.4% | KEV | 2019-05-02 |
| CVE-2023-27992 | Zyxel Multiple NAS Devices Command Injection Vulnerability | Zyxel | 9.8 | 82.8% | KEV | 2023-06-19 |
| CVE-2023-33010 | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Zyxel | 9.8 | 29.0% | KEV | 2023-05-24 |
| CVE-2023-33009 | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Zyxel | 9.8 | 28.1% | KEV | 2023-05-24 |
| CVE-2023-28771 | Zyxel Multiple Firewalls OS Command Injection Vulnerability | Zyxel | 9.8 | 99.3% | KEV | 2023-04-25 |
| CVE-2022-30525 | Zyxel Multiple Firewalls OS Command Injection Vulnerability | Zyxel | 9.8 | 99.9% | KEV | 2022-05-12 |
| CVE-2020-9054 | ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi | ZyXEL | 9.8 | 100.0% | KEV | 2020-03-04 |
| CVE-2020-29583 | Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability | - | 9.8 | 90.2% | KEV | 2020-12-22 |
Frequently Asked Questions
How many Zyxel vulnerabilities are actively exploited?→
13 Zyxel CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-09. The latest was added on 2026-09-21.
Which Zyxel vulnerabilities are used in ransomware attacks?→
CISA marks 2 Zyxel KEV entries as known to be used in ransomware campaigns, including CVE-2024-11667, CVE-2017-6884.
Which Zyxel products have the most exploited vulnerabilities?→
- +Multiple Firewalls: 5 CVEs (5 in KEV)
- +DSL CPE Devices: 2 CVEs (2 in KEV)
- +Multiple Network-Attached Storage (NAS) Devices: 2 CVEs (2 in KEV)
- +EMG2926 Routers: 1 CVE (1 in KEV)
- +GS1900 Series Switches: 1 CVE (1 in KEV)
Where does Zyxel publish security advisories?→
Zyxel publishes security advisories at https://www.zyxel.com/global/en/support/security-advisories. Check the vendor advisory for fixed versions and workarounds before applying updates.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Vendor and product names for exploited CVEs follow the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not affiliated with or endorsed by Zyxel, MITRE, CISA, or FIRST.