Zyxel
In 5 briefs, most recently 5 November 2026. RSS for this tag
Learn more: Vulnerabilities (NVD) ↗
Known exploited (CISA KEV)
13 Zyxel vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 2 of them used in ransomware campaigns. Most recent:
- CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2024-40891 Zyxel DSL CPE OS Command Injection Vulnerability
- CVE-2024-40890 Zyxel DSL CPE OS Command Injection Vulnerability
- CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerability
- CVE-2017-6884 Zyxel EMG2926 Routers Command Injection Vulnerability
- CVE-2017-18368 Zyxel P660HN-T1A Routers Command Injection Vulnerability
- CVE-2023-27992 Zyxel Multiple NAS Devices Command Injection Vulnerability
- CVE-2023-33010 Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Coverage in DanSec Daily
- Zyxel GS1900 zero-day hit nearly 1,000 switches, OpenSSH 'sshole' flaw on musl systems, and Chainalysis confirms all users' tokens exposed.
- The ShinyHunters FBI breach claim, the F5 BIG-IP APM zero-day CVE-2026-94127, and the Miljödata GDPR fine, plus other vulnerabilities and threat actor activity.
- Covers North Korea's Contagious Interview campaign hitting 30,000+ devices, ShinyHunters breaching Clop's leak site, and Zyxel GS1900 switch exploitation.
- ManoMano breach hits 38M customers, Cisco SD-WAN zero-day CVE-2026-20127 exploited for three years, and US sanctions on exploit broker Operation Zero.
- UNC2814 espionage hit 53 orgs in 42 countries; Cisco SD-WAN flaw CVE-2026-20127 drew a CISA emergency directive; CarGurus breach hits 12M users.