{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Zyxel vulnerabilities","home_page_url":"https://patchfirst.co/vendor/zyxel/","feed_url":"https://patchfirst.co/feed/vendor/zyxel.json","description":"New and newly exploited Zyxel CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-7273#kev","url":"https://patchfirst.co/cve/CVE-2026-7273/","title":"[KEV] CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","content_text":"Zyxel · GS1900 Series Switches. In CISA KEV since 2026-09-21. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 76.4 of 100.","summary":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","date_published":"2026-09-21T00:00:00.000Z","date_modified":"2026-10-25T23:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":76.4,"kev":{"dateAdded":"2026-09-21","ransomware":false},"epss":{"score":0.02778,"percentile":0.86351},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"GS1900 Series Switches","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-7673","url":"https://patchfirst.co/cve/CVE-2025-7673/","title":"CVE-2025-7673: A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions…","content_text":"Zyxel · VMG8825-T50K firmware. Not in CISA KEV. EPSS 0.7% (higher than 51.2% of CVEs). CVSS 9.8 CRITICAL. Priority 52.1 of 100.","summary":"A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions…","date_published":"2025-07-16T00:00:00.000Z","date_modified":"2026-02-26T17:50:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":52.1,"kev":null,"epss":{"score":0.00652,"percentile":0.51233},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"VMG8825-T50K firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-40891#kev","url":"https://patchfirst.co/cve/CVE-2024-40891/","title":"[KEV] CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability","content_text":"Zyxel · DSL CPE Devices. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 22.9% (higher than 97.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1055 Process Injection; T1011 Exfiltration Over Other Network Medium. Priority 68.7 of 100.","summary":"Zyxel DSL CPE OS Command Injection Vulnerability","date_published":"2025-02-11T00:00:00.000Z","date_modified":"2026-06-17T07:46:48.000Z","tags":["kev","public-exploit","T1055","T1011"],"_patchfirst":{"reason":"kev","priority":68.7,"kev":{"dateAdded":"2025-02-11","ransomware":false},"epss":{"score":0.22888,"percentile":0.97737},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"DSL CPE Devices","techniqueIds":["T1055","T1011"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-40890#kev","url":"https://patchfirst.co/cve/CVE-2024-40890/","title":"[KEV] CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability","content_text":"Zyxel · DSL CPE Devices. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 20.7% (higher than 97.5% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1055 Process Injection; T1011 Exfiltration Over Other Network Medium. Priority 63.7 of 100.","summary":"Zyxel DSL CPE OS Command Injection Vulnerability","date_published":"2025-02-11T00:00:00.000Z","date_modified":"2026-06-17T07:46:48.000Z","tags":["kev","T1055","T1011"],"_patchfirst":{"reason":"kev","priority":63.7,"kev":{"dateAdded":"2025-02-11","ransomware":false},"epss":{"score":0.20703,"percentile":0.97529},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"DSL CPE Devices","techniqueIds":["T1055","T1011"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-0890","url":"https://patchfirst.co/cve/CVE-2025-0890/","title":"CVE-2025-0890: **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel…","content_text":"Zyxel · VMG4325-B10A firmware. Not in CISA KEV. EPSS 14.4% (higher than 96.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 71.2 of 100.","summary":"**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel…","date_published":"2025-02-04T00:00:00.000Z","date_modified":"2025-02-12T20:51:26.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":71.2,"kev":null,"epss":{"score":0.14379,"percentile":0.96614},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"VMG4325-B10A firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-11667#kev","url":"https://patchfirst.co/cve/CVE-2024-11667/","title":"[KEV] CVE-2024-11667: Zyxel Multiple Firewalls Path Traversal Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2024-12-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 2.9% (higher than 87.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1105 Ingress Tool Transfer. Priority 72.3 of 100.","summary":"Zyxel Multiple Firewalls Path Traversal Vulnerability","date_published":"2024-12-03T00:00:00.000Z","date_modified":"2026-08-05T05:16:40.000Z","tags":["kev","ransomware","T1190","T1005","T1105"],"_patchfirst":{"reason":"kev","priority":72.3,"kev":{"dateAdded":"2024-12-03","ransomware":true},"epss":{"score":0.02929,"percentile":0.8706},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1005","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-42057","url":"https://patchfirst.co/cve/CVE-2024-42057/","title":"CVE-2024-42057: A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through…","content_text":"Zyxel · ATP series firmware. Not in CISA KEV. EPSS 1.3% (higher than 70.8% of CVEs). CVSS 8.1 HIGH. Priority 66.2 of 100.","summary":"A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through…","date_published":"2024-09-03T00:00:00.000Z","date_modified":"2024-09-03T13:54:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":66.2,"kev":null,"epss":{"score":0.0132,"percentile":0.70819},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"ATP series firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-29973","url":"https://patchfirst.co/cve/CVE-2024-29973/","title":"CVE-2024-29973: ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326…","content_text":"Zyxel · NAS326 firmware. Not in CISA KEV. EPSS 86.2% (higher than 99.73% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 69.2 of 100.","summary":"** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326…","date_published":"2024-06-04T00:00:00.000Z","date_modified":"2024-08-02T01:17:58.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":69.2,"kev":null,"epss":{"score":0.86205,"percentile":0.99733},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"NAS326 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-29972","url":"https://patchfirst.co/cve/CVE-2024-29972/","title":"CVE-2024-29972: ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program \"remote_help-cgi\" in Zyxel…","content_text":"Zyxel · NAS326 firmware. Not in CISA KEV. EPSS 90.3% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 66.8 of 100.","summary":"** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program \"remote_help-cgi\" in Zyxel…","date_published":"2024-06-04T00:00:00.000Z","date_modified":"2024-08-02T01:17:58.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.8,"kev":null,"epss":{"score":0.90349,"percentile":0.99798},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"NAS326 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-4473","url":"https://patchfirst.co/cve/CVE-2023-4473/","title":"CVE-2023-4473: A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542…","content_text":"Zyxel · NAS326 firmware. Not in CISA KEV. EPSS 41.3% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Priority 62.7 of 100.","summary":"A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542…","date_published":"2023-11-30T00:00:00.000Z","date_modified":"2025-12-16T18:23:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":62.7,"kev":null,"epss":{"score":0.41348,"percentile":0.98669},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"NAS326 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-4474","url":"https://patchfirst.co/cve/CVE-2023-4474/","title":"CVE-2023-4474: The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version…","content_text":"Zyxel · NAS326 firmware. Not in CISA KEV. EPSS 29.7% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Priority 61.5 of 100.","summary":"The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version…","date_published":"2023-11-30T00:00:00.000Z","date_modified":"2025-12-16T18:23:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":61.5,"kev":null,"epss":{"score":0.2974,"percentile":0.98195},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"NAS326 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-37928","url":"https://patchfirst.co/cve/CVE-2023-37928/","title":"CVE-2023-37928: A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version…","content_text":"Zyxel · NAS326 firmware. Not in CISA KEV. EPSS 60.2% (higher than 99.13% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.","summary":"A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version…","date_published":"2023-11-30T00:00:00.000Z","date_modified":"2025-02-13T17:01:40.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26,"kev":null,"epss":{"score":0.602,"percentile":0.99135},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"NAS326 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2017-6884#kev","url":"https://patchfirst.co/cve/CVE-2017-6884/","title":"[KEV] CVE-2017-6884: Zyxel EMG2926 Routers Command Injection Vulnerability","content_text":"Zyxel · EMG2926 Routers. In CISA KEV since 2023-09-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 33.0% (higher than 98.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.8 of 100.","summary":"Zyxel EMG2926 Routers Command Injection Vulnerability","date_published":"2023-09-18T00:00:00.000Z","date_modified":"2026-10-01T19:17:13.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.8,"kev":{"dateAdded":"2023-09-18","ransomware":true},"epss":{"score":0.32976,"percentile":0.98357},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"EMG2926 Routers","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-18368#kev","url":"https://patchfirst.co/cve/CVE-2017-18368/","title":"[KEV] CVE-2017-18368: Zyxel P660HN-T1A Routers Command Injection Vulnerability","content_text":"Zyxel · P660HN-T1A Routers. In CISA KEV since 2023-08-07. ENISA EUVD lists it as exploited. EPSS 94.5% (higher than 99.85% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.","summary":"Zyxel P660HN-T1A Routers Command Injection Vulnerability","date_published":"2023-08-07T00:00:00.000Z","date_modified":"2026-06-17T01:12:42.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2023-08-07","ransomware":false},"epss":{"score":0.94508,"percentile":0.99853},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"P660HN-T1A Routers","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27992#kev","url":"https://patchfirst.co/cve/CVE-2023-27992/","title":"[KEV] CVE-2023-27992: Zyxel Multiple NAS Devices Command Injection Vulnerability","content_text":"Zyxel · Multiple Network-Attached Storage (NAS) Devices. In CISA KEV since 2023-06-23. ENISA EUVD lists it as exploited. EPSS 82.3% (higher than 99.66% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 64.8 of 100.","summary":"Zyxel Multiple NAS Devices Command Injection Vulnerability","date_published":"2023-06-23T00:00:00.000Z","date_modified":"2026-06-17T05:46:20.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":64.8,"kev":{"dateAdded":"2023-06-23","ransomware":false},"epss":{"score":0.82264,"percentile":0.99658},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Network-Attached Storage (NAS) Devices","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-33010#kev","url":"https://patchfirst.co/cve/CVE-2023-33010/","title":"[KEV] CVE-2023-33010: Zyxel Multiple Firewalls Buffer Overflow Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2023-06-05. ENISA EUVD lists it as exploited. EPSS 29.0% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.5 of 100.","summary":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","date_published":"2023-06-05T00:00:00.000Z","date_modified":"2026-06-17T06:00:17.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.5,"kev":{"dateAdded":"2023-06-05","ransomware":false},"epss":{"score":0.29024,"percentile":0.98157},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-33009#kev","url":"https://patchfirst.co/cve/CVE-2023-33009/","title":"[KEV] CVE-2023-33009: Zyxel Multiple Firewalls Buffer Overflow Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2023-06-05. ENISA EUVD lists it as exploited. EPSS 28.1% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.5 of 100.","summary":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","date_published":"2023-06-05T00:00:00.000Z","date_modified":"2026-06-17T06:00:16.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.5,"kev":{"dateAdded":"2023-06-05","ransomware":false},"epss":{"score":0.28144,"percentile":0.98108},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-28771#kev","url":"https://patchfirst.co/cve/CVE-2023-28771/","title":"[KEV] CVE-2023-28771: Zyxel Multiple Firewalls OS Command Injection Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2023-05-31. ENISA EUVD lists it as exploited. EPSS 99.3% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","date_published":"2023-05-31T00:00:00.000Z","date_modified":"2026-06-17T05:48:44.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-05-31","ransomware":false},"epss":{"score":0.99284,"percentile":0.99937},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-28769","url":"https://patchfirst.co/cve/CVE-2023-28769/","title":"CVE-2023-28769: The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware…","content_text":"Zyxel · DX5401-B0 firmware. Not in CISA KEV. EPSS 5.4% (higher than 92.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 65.4 of 100.","summary":"The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware…","date_published":"2023-04-27T00:00:00.000Z","date_modified":"2025-01-31T18:43:25.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65.4,"kev":null,"epss":{"score":0.0542,"percentile":0.92692},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"DX5401-B0 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-28770","url":"https://patchfirst.co/cve/CVE-2023-28770/","title":"CVE-2023-28770: The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0…","content_text":"Zyxel · DX5401-B0 firmware. Not in CISA KEV. EPSS 57.8% (higher than 99.08% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 65.1 of 100.","summary":"The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0…","date_published":"2023-04-27T00:00:00.000Z","date_modified":"2025-01-31T18:42:32.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65.1,"kev":null,"epss":{"score":0.57778,"percentile":0.99084},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"DX5401-B0 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-45440","url":"https://patchfirst.co/cve/CVE-2022-45440/","title":"CVE-2022-45440: A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes…","content_text":"Zyxel · AX7501-B0 firmware. Not in CISA KEV. EPSS 0.2% (higher than 16.3% of CVEs). CVSS 4.4 MEDIUM. Priority 41.3 of 100.","summary":"A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes…","date_published":"2023-01-17T00:00:00.000Z","date_modified":"2025-12-17T08:33:35.000Z","tags":[],"_patchfirst":{"reason":"published","priority":41.3,"kev":null,"epss":{"score":0.00249,"percentile":0.16273},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Zyxel","product":"AX7501-B0 firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-30525#kev","url":"https://patchfirst.co/cve/CVE-2022-30525/","title":"[KEV] CVE-2022-30525: Zyxel Multiple Firewalls OS Command Injection Vulnerability","content_text":"Zyxel · Multiple Firewalls. In CISA KEV since 2022-05-16. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","date_published":"2022-05-16T00:00:00.000Z","date_modified":"2026-06-17T04:43:46.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2022-05-16","ransomware":false},"epss":{"score":0.99944,"percentile":0.99973},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Firewalls","techniqueIds":["T1190","T1059"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-0342","url":"https://patchfirst.co/cve/CVE-2022-0342/","title":"CVE-2022-0342: An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through…","content_text":"Zyxel · USG/ZyWALL series firmware. Not in CISA KEV. EPSS 95.1% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 67.5 of 100.","summary":"An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through…","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2024-08-02T23:25:40.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.5,"kev":null,"epss":{"score":0.95134,"percentile":0.99863},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"USG/ZyWALL series firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-9054#kev","url":"https://patchfirst.co/cve/CVE-2020-9054/","title":"[KEV] CVE-2020-9054: Zyxel Multiple NAS Devices OS Command Injection Vulnerability","content_text":"Zyxel · Multiple Network-Attached Storage (NAS) Devices. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Zyxel Multiple NAS Devices OS Command Injection Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-10-08T13:38:30.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.99988,"percentile":0.99984},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Network-Attached Storage (NAS) Devices","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-4039","url":"https://patchfirst.co/cve/CVE-2021-4039/","title":"CVE-2021-4039: A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to…","content_text":"Zyxel · NWA1100-NH firmware. Not in CISA KEV. EPSS 71.0% (higher than 99.4% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 68.9 of 100.","summary":"A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to…","date_published":"2022-03-01T00:00:00.000Z","date_modified":"2024-08-03T17:16:03.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":68.9,"kev":null,"epss":{"score":0.71048,"percentile":0.99404},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"NWA1100-NH firmware","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-29583#kev","url":"https://patchfirst.co/cve/CVE-2020-29583/","title":"[KEV] CVE-2020-29583: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability","content_text":"Zyxel · Multiple Products. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 90.2% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts. Priority 69.8 of 100.","summary":"Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:11:28.000Z","tags":["kev","public-exploit","T1078"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.90155,"percentile":0.99796},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zyxel","product":"Multiple Products","techniqueIds":["T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}