[ Vendor · 16 CVEs ]
Zyxel
CVEs affecting Zyxel published in the last 30 days, plus any Zyxel CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-12489 | 20 Oct 2026 | CVSS 6.5 | Zyxel EX3501-T0 firmwareAn incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an… | |
| CVE-2026-7273 | 16 Jun 2026 | CVSS 8.8 | Zyxel GS1900 Series Switches Stack-Based Buffer OverflowA stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a… | Exploited |
| CVE-2024-40890 | 4 Feb 2025 | CVSS 8.8 | Zyxel DSL CPE OS Command Injection**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A… | Exploited |
| CVE-2024-40891 | 4 Feb 2025 | CVSS 8.8 | Zyxel DSL CPE OS Command Injection**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel… | Exploited |
| CVE-2024-11667 | 27 Nov 2024 | CVSS 9.8 | Zyxel Multiple Firewalls Path TraversalA directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series… | Exploited |
| CVE-2024-11667 | 27 Nov 2024 | CVSS 9.8 | Zyxel Multiple Firewalls Path TraversalA directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series… | Exploited |
| CVE-2023-27992 | 19 Jun 2023 | CVSS 9.8 | Zyxel Multiple NAS Devices Command InjectionThe pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions… | ExploitedFix |
| CVE-2023-33009 | 24 May 2023 | CVSS 9.8 | Zyxel Multiple Firewalls Buffer OverflowA buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series… | Exploited |
| CVE-2023-33010 | 24 May 2023 | CVSS 9.8 | Zyxel Multiple Firewalls Buffer OverflowA buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series… | Exploited |
| CVE-2023-28771 | 25 Apr 2023 | CVSS 9.8 | Zyxel Multiple Firewalls OS Command InjectionImproper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG… | Exploited |
| CVE-2022-30525 | 12 May 2022 | CVSS 9.8 | Zyxel Multiple Firewalls OS Command InjectionA OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware… | Exploited |
| CVE-2020-29583 | 22 Dec 2020 | CVSS 9.8 | Zyxel Multiple Products Use of Hard-Coded CredentialsFirmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can… | Exploited |
| CVE-2020-9054 | 4 Mar 2020 | CVSS 9.8 | Zyxel Multiple NAS Devices OS Command InjectionMultiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability… | Exploited |
| CVE-2020-9054 | 4 Mar 2020 | CVSS 9.8 | Zyxel Multiple NAS Devices OS Command InjectionMultiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability… | Exploited |
| CVE-2017-18368 | 2 May 2019 | CVSS 9.8 | Zyxel P660HN-T1A Routers Command InjectionThe ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the… | Exploited |
| CVE-2017-6884 | 6 Apr 2017 | CVSS 8.8 | Zyxel EMG2926 Routers Command InjectionA command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the… | Exploited |