Brand

Zyxel: actively exploited vulnerabilities

13 vulnerabilities in Zyxel products (Firewalls (ATP, USG FLEX, ZyWALL/USG), Home gateways and routers (DSL, CPE), NAS…) are in CISA’s catalog of exploited vulnerabilities, 1 of them added in the last 90 days. Last added: September 21, 2026.

Zyxel security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

1 vulnerability added in the last 12 months
13 exploited vulnerabilities in the catalog, in total
1 added in the last 30 days

By category

Add just one Zyxel category to your radar, or open its page.

Firewalls, VPNs and remote access 6 vulnerabilities
Home and small-office routers, cameras and IoT 4 vulnerabilities
Backup, storage and NAS 2 vulnerabilities
Switches, routers and SD-WAN 1 vulnerability

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Firewalls (ATP, USG FLEX, ZyWALL/USG) 6 vulnerabilities · Firewalls and VPNs
Home gateways and routers (DSL, CPE) 4 vulnerabilities · Home routers and IoT
NAS 2 vulnerabilities · Backup and NAS
Switches (GS, XGS) 1 vulnerability · Switches and routers

Name used by CISA: Zyxel. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Zyxel list.

Rank 1Zyxel Switches (GS, XGS)
CVE-2026-7273
Recently addedHunt for compromise (CISA)
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Added to the catalog less than 30 days ago: ranked by date added.
Added
Sep 21, 2026
CISA deadline
3 days
CVSS severity
8.8 (high)
Rank 2Zyxel Firewalls (ATP, USG FLEX, ZyWALL/USG)
CVE-2024-11667
Ransomware
Zyxel Multiple Firewalls Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Dec 3, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 3Zyxel Home gateways and routers (DSL, CPE)
CVE-2017-18368
CVE from 2017, added in 2023
Zyxel P660HN-T1A Routers Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Aug 7, 2023
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 4Zyxel NAS
CVE-2023-27992
Zyxel Multiple NAS Devices Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 23, 2023
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 5Zyxel Firewalls (ATP, USG FLEX, ZyWALL/USG)
CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 5, 2023
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 6Zyxel Firewalls (ATP, USG FLEX, ZyWALL/USG)
CVE-2023-33010
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 5, 2023
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 7Zyxel Firewalls (ATP, USG FLEX, ZyWALL/USG)
CVE-2023-28771
Zyxel Multiple Firewalls OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
May 31, 2023
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 8Zyxel Firewalls (ATP, USG FLEX, ZyWALL/USG)
CVE-2022-30525
Zyxel Multiple Firewalls OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
May 16, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 9Zyxel NAS
CVE-2020-9054
CVE from 2020, added in 2022
Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 25, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 10Zyxel Firewalls (ATP, USG FLEX, ZyWALL/USG)
CVE-2020-29583
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)

Show 3 more vulnerabilities

Rank 11Zyxel Home gateways and routers (DSL, CPE)
CVE-2024-40890
Zyxel DSL CPE OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Feb 11, 2025
CISA deadline
21 days
CVSS severity
8.8 (high)
Rank 12Zyxel Home gateways and routers (DSL, CPE)
CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Feb 11, 2025
CISA deadline
21 days
CVSS severity
8.8 (high)
Rank 13Zyxel Home gateways and routers (DSL, CPE)
CVE-2017-6884
RansomwareCVE from 2017, added in 2023
Zyxel EMG2926 Routers Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 18, 2023
CISA deadline
21 days
CVSS severity
8.8 (high)

Get new Zyxel vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

By category

Affected products

Patch first

Follow and verify