Zyxel flaws being used in attacks

CISA lists 13 flaws in Zyxel products as being used in attacks, most recently on 21 Sep 2026. 2 have been used in ransomware.

What to do

1. Update every Zyxel product you use.Install the updates Zyxel offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 21 Sep 2026
   Zyxel GS1900 Series Switches
   CVE-2026-7273Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
   Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
   CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all

   Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 11 Feb 2025
   Zyxel DSL CPE Devices
   CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
   Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
   CISA’s required actionThe impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Read all

   Users should discontinue product utilization if a current mitigation is unavailable.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 11 Feb 2025
   Zyxel DSL CPE Devices
   CVE-2024-40890Zyxel DSL CPE OS Command Injection Vulnerability
   Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
   CISA’s required actionThe impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Read all

   Users should discontinue product utilization if a current mitigation is unavailable.
   CVE recordNVD
4. Being used in attacksUsed in ransomwareAdded by CISA on 3 Dec 2024
   Zyxel Multiple Firewalls
   CVE-2024-11667Zyxel Multiple Firewalls Path Traversal Vulnerability
   Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
5. Being used in attacksUsed in ransomwareAdded by CISA on 18 Sep 2023
   Zyxel EMG2926 Routers
   CVE-2017-6884Zyxel EMG2926 Routers Command Injection Vulnerability
   Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
6. Being used in attacksAdded by CISA on 7 Aug 2023
   Zyxel P660HN-T1A Routers
   CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability
   Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
7. Being used in attacksAdded by CISA on 23 Jun 2023
   Zyxel Multiple Network-Attached Storage (NAS) Devices
   CVE-2023-27992Zyxel Multiple NAS Devices Command Injection Vulnerability
   Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
8. Being used in attacksAdded by CISA on 5 Jun 2023
   Zyxel Multiple Firewalls
   CVE-2023-33010Zyxel Multiple Firewalls Buffer Overflow Vulnerability
   Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
9. Being used in attacksAdded by CISA on 5 Jun 2023
   Zyxel Multiple Firewalls
   CVE-2023-33009Zyxel Multiple Firewalls Buffer Overflow Vulnerability
   Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
10. Being used in attacksAdded by CISA on 31 May 2023
    Zyxel Multiple Firewalls
    CVE-2023-28771Zyxel Multiple Firewalls OS Command Injection Vulnerability
    Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
11. Being used in attacksAdded by CISA on 16 May 2022
    Zyxel Multiple Firewalls
    CVE-2022-30525Zyxel Multiple Firewalls OS Command Injection Vulnerability
    A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
12. Being used in attacksAdded by CISA on 25 Mar 2022
    Zyxel Multiple Network-Attached Storage (NAS) Devices
    CVE-2020-9054Zyxel Multiple NAS Devices OS Command Injection Vulnerability
    Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
13. Being used in attacksAdded by CISA on 3 Nov 2021
    Zyxel Multiple Products
    CVE-2020-29583Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
    Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Zyxel on CISA’s site.