Vendor scorecard
CISA lists 13 Zyxel vulnerabilities as exploited in the wild, 1 of them added in the last 12 months (down from 3 in the 12 months before). 2 (15%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 7 days. Most affected: Multiple Firewalls (5), DSL CPE Devices (2), Multiple Network-Attached Storage (NAS) Devices (2).
| Product | KEV entries |
|---|---|
| Multiple Firewalls | 5 |
| DSL CPE Devices | 2 |
| Multiple Network-Attached Storage (NAS) Devices | 2 |
| GS1900 Series Switches | 1 |
| EMG2926 Routers | 1 |
| P660HN-T1A Routers | 1 |
| Multiple Products | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityGS1900 Series Switches | |
| CVE-2024-40891 | Zyxel DSL CPE OS Command Injection VulnerabilityDSL CPE Devices | |
| CVE-2024-40890 | Zyxel DSL CPE OS Command Injection VulnerabilityDSL CPE Devices | |
| CVE-2024-11667 | Zyxel Multiple Firewalls Path Traversal VulnerabilityRANSOMWAREMultiple Firewalls | |
| CVE-2017-6884 | Zyxel EMG2926 Routers Command Injection VulnerabilityRANSOMWAREEMG2926 Routers | |
| CVE-2017-18368 | Zyxel P660HN-T1A Routers Command Injection VulnerabilityP660HN-T1A Routers | |
| CVE-2023-27992 | Zyxel Multiple NAS Devices Command Injection VulnerabilityMultiple Network-Attached Storage (NAS) Devices | |
| CVE-2023-33010 | Zyxel Multiple Firewalls Buffer Overflow VulnerabilityMultiple Firewalls | |
| CVE-2023-33009 | Zyxel Multiple Firewalls Buffer Overflow VulnerabilityMultiple Firewalls | |
| CVE-2023-28771 | Zyxel Multiple Firewalls OS Command Injection VulnerabilityMultiple Firewalls | |
| CVE-2022-30525 | Zyxel Multiple Firewalls OS Command Injection VulnerabilityMultiple Firewalls | |
| CVE-2020-9054 | Zyxel Multiple NAS Devices OS Command Injection VulnerabilityMultiple Network-Attached Storage (NAS) Devices | |
| CVE-2020-29583 | Zyxel Multiple Products Use of Hard-Coded Credentials VulnerabilityMultiple Products |
Get an email when CISA adds the next Zyxel CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (4 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →