Patchfirst
Patchfirst

Vendor

Zyxel

13 of 26 Zyxel CVEs in Patchfirst (50%) are in of vulnerabilities exploited in the wild, 2 of them used by ransomware.

CVEs
26
In CISA KEV
1350%
Known ransomware use
2
Median days to KEV
12
from publication
Latest KEV listing
21 Sep 2026
Watch Zyxel Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • Multiple Firewalls In KEV: 5 CVEs: 5
  • DSL CPE Devices In KEV: 2 CVEs: 2
  • Multiple Network-Attached Storage (NAS) Devices In KEV: 2 CVEs: 2
  • EMG2926 Routers In KEV: 1 CVEs: 1
  • GS1900 Series Switches In KEV: 1 CVEs: 1
  • Multiple Products In KEV: 1 CVEs: 1
  • P660HN-T1A Routers In KEV: 1 CVEs: 1
  • NAS326 firmware In KEV: 0 CVEs: 5
  • DX5401-B0 firmware In KEV: 0 CVEs: 2
  • ATP series firmware In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Zyxel CVEs
Open in ATT&CK Navigator

Counts are Zyxel CVEs linked to the technique. Each link’s provenance is on the CVE page.

Zyxel CVEs

26 CVEs, by priority
  1. CVE-2022-30525Zyxel Multiple Firewalls OS Command Injection Vulnerability
    Zyxel · Multiple FirewallsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports
    99.9%Top 0.03%
    86.0priority
  2. CVE-2017-6884Zyxel EMG2926 Routers Command Injection Vulnerability
    Zyxel · EMG2926 RoutersKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    33.0%Top 1.6%
    78.8priority
  3. CVE-2026-7273Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
    Zyxel · GS1900 Series SwitchesKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    2.8%Top 14%
    76.4priority
  4. CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability
    Zyxel · P660HN-T1A RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    94.5%Top 0.15%
    73.7priority
  5. CVE-2024-11667Zyxel Multiple Firewalls Path Traversal Vulnerability
    Zyxel · Multiple FirewallsKEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System+1 more
    2.9%Top 13%
    72.3priority
  6. CVE-2025-0890**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel…
    Zyxel · VMG4325-B10A firmwarePublic exploitCritical · 9.8
    14.4%Top 3.4%
    71.2priority
  7. CVE-2020-9054Zyxel Multiple NAS Devices OS Command Injection Vulnerability
    Zyxel · Multiple Network-Attached Storage (NAS) DevicesKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    >99.9%Top 0.02%
    69.9priority
  8. CVE-2023-28771Zyxel Multiple Firewalls OS Command Injection Vulnerability
    Zyxel · Multiple FirewallsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    99.3%Top 0.06%
    69.8priority
  9. CVE-2020-29583Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
    Zyxel · Multiple ProductsKEVPublic exploitCritical · 9.8T1078Valid Accounts
    90.2%Top 0.2%
    69.8priority
  10. CVE-2024-29973** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326…
    Zyxel · NAS326 firmwarePublic exploitCritical · 9.8
    86.2%Top 0.27%
    69.2priority
  11. CVE-2021-4039A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to…
    Zyxel · NWA1100-NH firmwarePublic exploitCritical · 9.8
    71.0%Top 0.6%
    68.9priority
  12. CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
    Zyxel · DSL CPE DevicesKEVPublic exploitHigh · 8.8T1055Process InjectionT1011Exfiltration Over Other Network Medium
    22.9%Top 2.3%
    68.7priority
  13. CVE-2022-0342An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through…
    Zyxel · USG/ZyWALL series firmwarePublic exploitCritical · 9.8
    95.1%Top 0.14%
    67.5priority
  14. CVE-2024-29972** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel…
    Zyxel · NAS326 firmwarePublic exploitCritical · 9.8
    90.3%Top 0.2%
    66.8priority
  15. CVE-2024-42057A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through…
    Zyxel · ATP series firmwareHigh · 8.1
    1.3%Top 29%
    66.2priority
  16. CVE-2023-28769The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware…
    Zyxel · DX5401-B0 firmwarePublic exploitCritical · 9.8
    5.4%Top 7.3%
    65.4priority
  17. CVE-2023-28770The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0…
    Zyxel · DX5401-B0 firmwarePublic exploitHigh · 7.5
    57.8%Top 0.92%
    65.1priority
  18. CVE-2023-27992Zyxel Multiple NAS Devices Command Injection Vulnerability
    Zyxel · Multiple Network-Attached Storage (NAS) DevicesKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    82.3%Top 0.34%
    64.8priority
  19. CVE-2023-33010Zyxel Multiple Firewalls Buffer Overflow Vulnerability
    Zyxel · Multiple FirewallsKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    29.0%Top 1.8%
    64.5priority
  20. CVE-2023-33009Zyxel Multiple Firewalls Buffer Overflow Vulnerability
    Zyxel · Multiple FirewallsKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    28.1%Top 1.9%
    64.5priority
  21. CVE-2024-40890Zyxel DSL CPE OS Command Injection Vulnerability
    Zyxel · DSL CPE DevicesKEVHigh · 8.8T1055Process InjectionT1011Exfiltration Over Other Network Medium
    20.7%Top 2.5%
    63.7priority
  22. CVE-2023-4473A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542…
    Zyxel · NAS326 firmwareCritical · 9.8
    41.3%Top 1.3%
    62.7priority
  23. CVE-2023-4474The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version…
    Zyxel · NAS326 firmwareCritical · 9.8
    29.7%Top 1.8%
    61.5priority
  24. CVE-2025-7673A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions…
    Zyxel · VMG8825-T50K firmwareCritical · 9.8
    0.7%Top 49%
    52.1priority
  25. CVE-2022-45440A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes…
    Zyxel · AX7501-B0 firmwareMedium · 4.4
    0.2%Top 84%
    41.3priority
  26. CVE-2023-37928A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version…
    Zyxel · NAS326 firmwareHigh · 8.8
    60.2%Top 0.87%
    26.0priority
↑ ↓ chooseEnter openEsc close