Vendor

Zyxel

As of , 13 Zyxel vulnerabilities are on CISA's list of exploited vulnerabilities, 2 of them used in ransomware campaigns; 1 was added in 2026. Patch first: CVE-2026-7273.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-7273Stack-Based Buffer OverflowZyxel GS1900 Series SwitchesPatch nowForensic triage required by CISA0.03
2CVE-2017-18368Command InjectionZyxel P660HN-T1A RoutersPatch this weekMetasploit module; EPSS 0.940.94
3CVE-2023-28771OS Command InjectionZyxel Multiple FirewallsPatch this weekMetasploit module; EPSS 0.990.99
4CVE-2022-30525OS Command InjectionZyxel Multiple FirewallsPatch this weekMetasploit module; EPSS 0.990.99
5CVE-2023-27992Multiple NAS Devices Command InjectionZyxel Multiple Network-Attached Storage (NAS) DevicesPatch this weekEPSS 0.830.83
6CVE-2020-9054Multiple NAS Devices OS Command InjectionZyxel Multiple Network-Attached Storage (NAS) DevicesPatch this weekEPSS 0.990.99
7CVE-2020-29583Use of Hard-Coded CredentialsZyxel Multiple ProductsPatch this weekEPSS 0.900.90
8CVE-2017-6884Command InjectionZyxel EMG2926 RoutersPatch this weekRansomware use0.35
9CVE-2024-11667Path TraversalZyxel Multiple FirewallsPatch this weekRansomware use0.03
10CVE-2023-33009Buffer OverflowZyxel Multiple FirewallsPatch soon0.28
11CVE-2023-33010Buffer OverflowZyxel Multiple FirewallsPatch soon0.29
12CVE-2024-40890DSL CPE OS Command InjectionZyxel DSL CPE DevicesPatch soon0.21
13CVE-2024-40891DSL CPE OS Command InjectionZyxel DSL CPE DevicesPatch soon0.22

Products

  • Multiple Firewalls5 entries
  • DSL CPE Devices2 entries
  • Multiple Network-Attached Storage (NAS) Devices2 entries
  • EMG2926 Routers1 entry
  • GS1900 Series Switches1 entry
  • Multiple Products1 entry
  • P660HN-T1A Routers1 entry

Added each year

2462021: 1120212022: 2220222023: 6620232024: 1120242025: 2220252026: 112026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20211
20222
20236
20241
20252
20261

Used in ransomware

Changes CISA made to these entries

  1. CVE-2017-6884 Zyxel EMG2926 RoutersRansomware use: Unknown to Known.
  2. CVE-2024-40891 Zyxel DSL CPE DevicesEdited: notes.
  3. CVE-2024-40890 Zyxel DSL CPE DevicesEdited: notes.

Every change we recorded