Zyxel
Vulnerability activity for Zyxel: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 90 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 21
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 8.8HighSep 21, 2026Zyxel GS1900 Series Switches Memory corruptionCVE-2026-7273Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.Added to KEV Sep 21, 2026Exploited2.5% likely
- 8.8HighFeb 4, 2025Zyxel DSL CPE Devices Code / command injectionCVE-2024-40890Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.Added to KEV Feb 11, 2025 · 7 days after publicationExploited21% likelyDetection
- 8.8HighFeb 4, 2025Zyxel DSL CPE Devices Code / command injectionCVE-2024-40891Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.Added to KEV Feb 11, 2025 · 7 days after publicationExploited23% likelyExploit codeDetection
- 7.5HighNov 27, 2024Zyxel Multiple Firewalls Path traversal / file handlingCVE-2024-11667Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.Added to KEV Dec 3, 2024 · 6 days after publicationExploited2.9% likely
- 8.8HighApr 6, 2017Zyxel EMG2926 Routers Code / command injectionCVE-2017-6884Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.Added to KEV Sep 18, 2023 · 2,355 days after publicationExploited33% likelyExploit codeExploit-DBDetection
- 9.8CriticalMay 2, 2019Zyxel P660HN-T1A Routers Code / command injectionCVE-2017-18368Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.Added to KEV Aug 7, 2023 · 1,557 days after publicationExploited95% likelyExploit codeMetasploitDetection
- 9.8CriticalJun 19, 2023Zyxel Multiple Network-Attached Storage (NAS) Devices Code / command injectionCVE-2023-27992Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.Added to KEV Jun 23, 2023 · 4 days after publicationExploited82% likely
- 9.8CriticalMay 24, 2023Zyxel Multiple Firewalls Memory corruptionCVE-2023-33010Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.Added to KEV Jun 5, 2023 · 12 days after publicationExploited29% likely
- 9.8CriticalMay 24, 2023Zyxel Multiple Firewalls Memory corruptionCVE-2023-33009Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.Added to KEV Jun 5, 2023 · 12 days after publicationExploited28% likely
- 9.8CriticalApr 25, 2023Zyxel Multiple Firewalls Code / command injectionCVE-2023-28771Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.Added to KEV May 31, 2023 · 36 days after publicationExploited99% likelyExploit codeMetasploitDetection
- 9.8CriticalMay 12, 2022Zyxel Multiple Firewalls Code / command injectionCVE-2022-30525A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.Added to KEV May 16, 2022 · 3 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalMar 4, 2020Zyxel Multiple Network-Attached Storage (NAS) Devices Code / command injectionCVE-2020-9054Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.Added to KEV Mar 25, 2022 · 750 days after publicationExploited100% likelyExploit codeNucleiDetection
- 9.8CriticalDec 22, 2020Zyxel Multiple Products Auth bypass / access controlCVE-2020-29583Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.Added to KEV Nov 3, 2021 · 316 days after publicationExploited90% likelyExploit codeNucleiDetection
Recent
- –UnscoredNov 3, 2026ZyxelADV-cccs-eaebfb9c6e0cSerial number: AV26-1114 Date: November 3, 2026 As of November 3, 2026, Zyxel is affected by vulnerabilities in the following products: Zyxel GS1900 series switches Multiple versions and models Zyxel APs, FWA7, and Security Routers Multiple versions and models The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches Zyxel s
- 8.8HighNov 3, 2026Zyxel NWA110AX firmware Memory corruptionCVE-2026-76955A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.
- 8.8HighNov 3, 2026Zyxel GS1900-24E firmware Memory corruptionCVE-2026-107441An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.Exploit code
- 6.5MediumOct 20, 2026Zyxel EX3501-T0 firmware Auth bypass / access controlCVE-2026-12489An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device.
- 8.8HighSep 21, 2026Zyxel GS1900 Series Switches Memory corruptionCVE-2026-7273Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.Exploited2.5% likely
- 7.5HighMay 12, 2026Zyxel nwa1100-n firmware Memory corruptionCVE-2026-7287** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.
- 4.4MediumMay 12, 2026Zyxel wre6505 firmware Information disclosureCVE-2026-7257** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file.
- 8.8HighMay 12, 2026Zyxel wre6505 firmware Code / command injectionCVE-2026-7256** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.
- 6.5MediumMay 12, 2026Zyxel wre6505 firmwareCVE-2026-7255** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and bypass authentication.
- 7.2HighApr 28, 2026Zyxel nebula fwa70 firmware Code / command injectionCVE-2026-1460A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
- 6.8MediumApr 28, 2026Zyxel nr5307 firmware Code / command injectionCVE-2026-0711A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device.
- 4.5MediumApr 21, 2026Zyxel wre6505 firmware Denial of serviceCVE-2026-6058** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the WLAN to cause a denial-of-service (DoS) condition in the web management interface by convincing an authenticated administrator to visit the “AP Select” page while a malformed SSID is present.
- 7.2HighFeb 24, 2026Zyxel vmg3625-t50c firmware Code / command injectionCVE-2026-1459A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.
- 8.8HighFeb 24, 2026Zyxel ex5601-t1 firmware Code / command injectionCVE-2025-13943A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device.1.5% likely
- 9.8CriticalFeb 24, 2026Zyxel wx5610-b0 firmware Code / command injectionCVE-2025-13942A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.1.2% likely
- 4.9MediumFeb 24, 2026Zyxel ex5601-t1 firmware Memory corruptionCVE-2025-11848A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.2.1% likely
- 4.9MediumFeb 24, 2026Zyxel ex3510-b1 firmware Memory corruptionCVE-2025-11847A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.1.9% likely
- 4.9MediumFeb 24, 2026Zyxel lte3301-plus firmware Memory corruptionCVE-2025-11846A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.1.3% likely
- 4.9MediumFeb 24, 2026Zyxel lte3301-plus firmware Memory corruptionCVE-2025-11845A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
- 8.8HighNov 18, 2025Zyxel dm4200-b0 firmware Code / command injectionCVE-2025-8693A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute operating system (OS) commands on an affected device.1% likely
- 5.3MediumNov 18, 2025Zyxel lte3301-plus firmware Denial of serviceCVE-2025-6599An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service (DoS) attacks. Such attacks may temporarily block legitimate HTTP requests and partially disrupt access to the web management interface, while other networking services remain unaffected.
- 8.8HighFeb 4, 2025Zyxel DSL CPE Devices Code / command injectionCVE-2024-40891Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.Exploited23% likelyExploit codeDetection
- 8.8HighFeb 4, 2025Zyxel DSL CPE Devices Code / command injectionCVE-2024-40890Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.Exploited21% likelyDetection
- 7.5HighNov 27, 2024Zyxel Multiple Firewalls Path traversal / file handlingCVE-2024-11667Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.Exploited2.9% likely
- 9.8CriticalJun 4, 2024Zyxel nas326 firmware Code / command injectionCVE-2024-29972** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.90% likelyExploit codeNucleiDetection
- 8.8HighApr 6, 2017Zyxel EMG2926 Routers Code / command injectionCVE-2017-6884Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.Exploited33% likelyExploit codeExploit-DBDetection
- 9.8CriticalMay 2, 2019Zyxel P660HN-T1A Routers Code / command injectionCVE-2017-18368Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.Exploited95% likelyExploit codeMetasploitDetection
- 9.8CriticalJun 19, 2023Zyxel Multiple Network-Attached Storage (NAS) Devices Code / command injectionCVE-2023-27992Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.Exploited82% likely
- 9.8CriticalMay 24, 2023Zyxel Multiple Firewalls Memory corruptionCVE-2023-33010Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.Exploited29% likely
- 9.8CriticalMay 24, 2023Zyxel Multiple Firewalls Memory corruptionCVE-2023-33009Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.Exploited28% likely
- 9.8CriticalApr 25, 2023Zyxel Multiple Firewalls Code / command injectionCVE-2023-28771Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.Exploited99% likelyExploit codeMetasploitDetection
- 9.8CriticalMay 12, 2022Zyxel Multiple Firewalls Code / command injectionCVE-2022-30525A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalMar 4, 2020Zyxel Multiple Network-Attached Storage (NAS) Devices Code / command injectionCVE-2020-9054Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.Exploited100% likelyExploit codeNucleiDetection
- 9.8CriticalDec 22, 2020Zyxel Multiple Products Auth bypass / access controlCVE-2020-29583Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.Exploited90% likelyExploit codeNucleiDetection
Top products
- wre6505 firmware4 CVEs in the last year
- lte3301-plus firmware3 CVEs in the last year
- ex5601-t1 firmware2 CVEs in the last year
- wx5610-b0 firmware1 CVE in the last year, 1 critical
- vmg3625-t50c firmware1 CVE in the last year
- NWA110AX firmware1 CVE in the last year
- nwa1100-n firmware1 CVE in the last year
- nr5307 firmware1 CVE in the last year
- nebula fwa70 firmware1 CVE in the last year
- GS1900-24E firmware1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Nov 3, 2026Zyxel security advisory (AV26-1114)ADV-cccs-eaebfb9c6e0c
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.