By year
01
02
04
05
06
07
08
09
11
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Zyxel flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer OverflowExploited since Sep 21, 2026 · CVSS 8.8
- CVE-2024-40891 Zyxel DSL CPE OS Command InjectionExploited since Feb 11, 2025 · CVSS 8.8
- CVE-2024-40890 Zyxel DSL CPE OS Command InjectionExploited since Feb 11, 2025 · CVSS 8.8
- CVE-2024-11667 Zyxel Multiple Firewalls Path TraversalExploited since Dec 3, 2024 · ransomware · CVSS 7.5
- CVE-2017-6884 Zyxel EMG2926 Routers Command InjectionExploited since Sep 18, 2023 · ransomware · CVSS 8.8
- CVE-2017-18368 Zyxel P660HN-T1A Routers Command InjectionExploited since Aug 7, 2023 · CVSS 9.8
- CVE-2023-27992 Zyxel Multiple NAS Devices Command InjectionExploited since Jun 23, 2023 · CVSS 9.8
- CVE-2023-33010 Zyxel Multiple Firewalls Buffer OverflowExploited since Jun 5, 2023 · CVSS 9.8
- CVE-2023-33009 Zyxel Multiple Firewalls Buffer OverflowExploited since Jun 5, 2023 · CVSS 9.8
- CVE-2023-28771 Zyxel Multiple Firewalls OS Command InjectionExploited since May 31, 2023 · CVSS 9.8
- CVE-2022-30525 Zyxel Multiple Firewalls OS Command InjectionExploited since May 16, 2022 · CVSS 9.8
- CVE-2020-9054 Zyxel Multiple NAS Devices OS Command InjectionExploited since Mar 25, 2022 · CVSS 9.8
- CVE-2020-29583 Zyxel Multiple Products Use of Hard-Coded CredentialsExploited since Nov 3, 2021 · CVSS 9.8
Latest high and critical flaws
- CVE-2026-6374 Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable.High 7.3 · Aug 10, 2026
- CVE-2026-13206 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection.Critical 9.8 · Aug 10, 2026
- CVE-2026-12984 Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data.High 8.2 · Aug 10, 2026
- CVE-2026-14818 A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USHigh 7.2 · Aug 4, 2026
- CVE-2026-6837 A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an aHigh 7.2 · Aug 3, 2026
- CVE-2026-6952 A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.High 7.2 · Jul 20, 2026
- CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer OverflowExploited · High 8.8 · Jun 15, 2026
- CVE-2026-7287 ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functionHigh 7.5 · May 12, 2026
- CVE-2026-7256 ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacenHigh 8.8 · May 12, 2026
- CVE-2026-1460 A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware verHigh 7.2 · Apr 27, 2026
- CVE-2026-1459 A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABHigh 7.2 · Feb 23, 2026
- CVE-2025-13943 A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could alHigh 8.8 · Feb 23, 2026
- CVE-2025-13942 A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execuCritical 9.8 · Feb 23, 2026
- CVE-2025-11730 A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 throuHigh 7.2 · Feb 4, 2026
- CVE-2025-8693 A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an auHigh 8.8 · Nov 17, 2025
- CVE-2025-9133 A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40High 8.1 · Oct 20, 2025
- CVE-2025-8078 A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.High 7.2 · Oct 20, 2025
- CVE-2025-7673 A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unautCritical 9.8 · Jul 16, 2025
- CVE-2025-6265 A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated atHigh 7.2 · Jul 14, 2025
- CVE-2025-1731 An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could High 7.8 · Apr 21, 2025
- CVE-2024-12010 A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier couHigh 7.2 · Mar 10, 2025
- CVE-2024-12009 A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier could allow aHigh 7.2 · Mar 10, 2025
- CVE-2024-11253 A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(AHigh 7.2 · Mar 10, 2025
- CVE-2025-0890 **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_2017Critical 9.8 · Feb 4, 2025
- CVE-2024-40891 Zyxel DSL CPE OS Command InjectionExploited · High 8.8 · Feb 4, 2025
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.