Vendor
Zyxel: actively exploited vulnerabilities
13 vulnerabilities in Zyxel products are listed in CISA’s catalog of actively exploited vulnerabilities, 2 of them used by ransomware. Latest addition on September 21, 2026: CVE-2026-7273 (GS1900 Series Switches).
- 13 exploited vulnerabilities in the catalog
- 1 added in the last 12 months
- 2 used by ransomware
- 7 products affected
Affected products
- Multiple Firewalls5
- DSL CPE Devices2
- Multiple Network-Attached Storage (NAS) Devices2
- EMG2926 Routers1
- GS1900 Series Switches1
- Multiple Products1
- P660HN-T1A Routers1
All exploited vulnerabilities
CISA KEV catalog, newest first: each entry corresponds to observed exploitation.
2026 1 vulnerability
-
CVE-2026-7273Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
2025 2 vulnerabilities
-
CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
-
CVE-2024-40890Zyxel DSL CPE OS Command Injection Vulnerability
2024 1 vulnerability
-
CVE-2024-11667Used by ransomwareZyxel Multiple Firewalls Path Traversal Vulnerability
2023 6 vulnerabilities
-
CVE-2017-6884Used by ransomwareZyxel EMG2926 Routers Command Injection Vulnerability
-
CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability
-
CVE-2023-27992Zyxel Multiple NAS Devices Command Injection Vulnerability
-
CVE-2023-33010Zyxel Multiple Firewalls Buffer Overflow Vulnerability
-
CVE-2023-33009Zyxel Multiple Firewalls Buffer Overflow Vulnerability
-
CVE-2023-28771Zyxel Multiple Firewalls OS Command Injection Vulnerability
2022 2 vulnerabilities
-
CVE-2022-30525Zyxel Multiple Firewalls OS Command Injection Vulnerability
-
CVE-2020-9054Zyxel Multiple NAS Devices OS Command Injection Vulnerability
2021 1 vulnerability
-
CVE-2020-29583Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
What to do
If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.
Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.