Zyxel known exploited vulnerabilities

CISA's Known Exploited Vulnerabilities catalog lists 13 Zyxel vulnerabilities: 1 added in the last 365 days, 8 rated critical (CVSS 9 or higher), and 2 with known ransomware use. The most recent was added Sep 21, 2026.

RSS feed for Zyxel exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant

Added to KEV	CVE	Vulnerability	CVSS	EPSS	Federal due date	Ransomware use
2026-09-21	CVE-2026-7273	Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability	8.8 (v3.1)	2.8%	2026-09-24	Unknown
2025-02-11	CVE-2024-40890	Zyxel DSL CPE OS Command Injection Vulnerability	8.8 (v3.1)	20.7%	2025-03-04	Unknown
2025-02-11	CVE-2024-40891	Zyxel DSL CPE OS Command Injection Vulnerability	8.8 (v3.1)	22.9%	2025-03-04	Unknown
2024-12-03	CVE-2024-11667	Zyxel Multiple Firewalls Path Traversal Vulnerability	7.5 (v3.1)	2.9%	2024-12-24	Known
2023-09-18	CVE-2017-6884	Zyxel EMG2926 Routers Command Injection Vulnerability	8.8 (v3.1)	33.0%	2023-10-09	Known
2023-08-07	CVE-2017-18368	Zyxel P660HN-T1A Routers Command Injection Vulnerability	9.8 (v3.1)	94.5%	2023-08-28	Unknown
2023-06-23	CVE-2023-27992	Zyxel Multiple NAS Devices Command Injection Vulnerability	9.8 (v3.1)	82.3%	2023-07-14	Unknown
2023-06-05	CVE-2023-33009	Zyxel Multiple Firewalls Buffer Overflow Vulnerability	9.8 (v3.1)	28.1%	2023-06-26	Unknown
2023-06-05	CVE-2023-33010	Zyxel Multiple Firewalls Buffer Overflow Vulnerability	9.8 (v3.1)	29.0%	2023-06-26	Unknown
2023-05-31	CVE-2023-28771	Zyxel Multiple Firewalls OS Command Injection Vulnerability	9.8 (v3.1)	99.3%	2023-06-21	Unknown
2022-05-16	CVE-2022-30525	Zyxel Multiple Firewalls OS Command Injection Vulnerability	9.8 (v3.1)	>99.9%	2022-06-06	Unknown
2022-03-25	CVE-2020-9054	Zyxel Multiple NAS Devices OS Command Injection Vulnerability	9.8 (v3.1)	>99.9%	2022-04-15	Unknown
2021-11-03	CVE-2020-29583	Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability	9.8 (v3.1)	90.2%	2022-05-03	Unknown