Zyxel vulnerabilities
Published CVEs affecting Zyxel products: 39 record(s), with severity, exploitation and fixes.
Px5301-t0 Firmware 10Ax7501-b1 Firmware 10Vmg8623-t50b Firmware 10Ex5512-t0 Firmware 10Vmg3625-t50b Firmware 10Dx5401-b1 Firmware 10Ee6510-10 Firmware 10Emg3525-t50b Firmware 10Emg5523-t50b Firmware 10Pe3301-00 Firmware 9Wx5600-t0 Firmware 9ATP series firmware 9Pe5301-01 Firmware 9Ex3501-t0 Firmware 9We3300-00 Firmware 9Ex5601-t0 Firmware 9Ex5401-b1 Firmware 9Ex7501-b0 Firmware 9Ex7710-b0 Firmware 9Ex5601-t1 Firmware 9Ex3600-t0 Firmware 9Ex3500-t0 Firmware 9Ex3301-t0 Firmware 9Ex3300-t1 Firmware 9Ee5301-00 Firmware 9Ee3301-00 Firmware 9Dx3301-t0 Firmware 9Dx3300-t1 Firmware 9Dx3300-t0 Firmware 9Ex3300-t0 Firmware 9Vmg4005-b60a Firmware 8Ex5510-b0 Firmware 8Px3321-t1 Firmware 8USG FLEX series firmware 8Wx3100-t0 Firmware 8Wx5610-b0 Firmware 8Gm4100-b0 Firmware 8Vmg4005-b50a Firmware 8Dx4510-b1 Firmware 8Pm5100-t0 Firmware 7
CVE-2026-14818
High · 7.2
CWE-22 Aug 4, 2026
Path Traversal in Zyxel ATP series firmware
A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50(W) series firmware versions from V4.16 through V5.42 Patch 1, and USG20(W)-VPN series firmware versions from V4.16 through V5.42 Patch 1 could allow an authenticated attacker with administrator privileges to execute a crafted malicious configuration file on an affected device.
CVE-2026-8508
Medium · 6.5
CWE-287 Aug 4, 2026
Improper Authentication in Zyxel WAX650S firmware
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.
CVE-2026-6837
High · 7.2
CWE-78 Aug 4, 2026
OS Command Injection in Zyxel WAX650S firmware
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
CVE-2026-6952
High · 7.2
CWE-78 Jul 21, 2026
OS Command Injection in Zyxel Ax7501-b1 Firmware
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
CVE-2026-7273
High · 8.8
KEV High · 54 CWE-121 Jun 16, 2026
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
CVE-2026-3871
Medium · 6.5
CWE-120 Jun 2, 2026
Classic Buffer Overflow in Zyxel Vmg4005-b50b Firmware
A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent attacker to trigger a temporary denial-of-service (DoS) condition affecting the UPnP function of the affected device.
CVE-2026-3870
Medium · 6.5
CWE-120 Jun 2, 2026
Classic Buffer Overflow in Zyxel Vmg4005-b50b Firmware
A buffer overflow vulnerability in the UPnP AddPortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent attacker to trigger a temporary denial-of-service (DoS) condition affecting the UPnP function of the affected device.
CVE-2026-4795
Medium · 6.5
CWE-862 May 25, 2026
Missing Authorization in Zyxel GS1200-5v3 firmware
A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.00(ACPT.2)C0, GS1200-5HPv3 firmware versions through 1.00(ACPU.2)C0, GS1200-8HPv3 firmware versions through 1.00(ACPV.2)C0, and GS1200-10v3 firmware versions through 1.00(ACPW.2)C0 could allow a LAN-based, unauthenticated attacker to read the system configuration from a log file via a crafted HTTP request.
CVE-2026-7287
High · 7.5
CWE-120 May 12, 2026
Classic Buffer Overflow in Zyxel Nwa1100-n Firmware
** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.
CVE-2026-7257
Medium · 4.4
CWE-922 May 12, 2026
Insecure Storage of Sensitive Information in Zyxel Wre6505 Firmware
** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file.
CVE-2026-7256
High · 8.8
CWE-78 May 12, 2026
OS Command Injection in Zyxel Wre6505 Firmware
** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.
CVE-2026-7255
Medium · 6.5
CWE-307 May 12, 2026
Improper Restriction of Excessive Authentication Attempts in Zyxel Wre6505 Firmware
** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and bypass authentication.
CVE-2026-1460
High · 7.2
CWE-78 Apr 28, 2026
OS Command Injection in Zyxel Nebula Fwa70 Firmware
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
CVE-2026-0711
Medium · 6.8
CWE-78 Apr 28, 2026
OS Command Injection in Zyxel Nr5307 Firmware
A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device.
CVE-2026-6058
Medium · 5.7
CWE-116 Apr 20, 2026
Improper Encoding or Escaping of Output in Zyxel Wre6505 Firmware
** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the WLAN to cause a denial-of-service (DoS) condition in the web management interface by convincing an authenticated administrator to visit the “AP Select” page while a malformed SSID is present.
CVE-2026-1459
High · 7.2
CWE-78 Feb 24, 2026
OS Command Injection in Zyxel Vmg3625-t50c Firmware
A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.
CVE-2025-13943
High · 8.8
CWE-78 Feb 24, 2026
OS Command Injection in Zyxel Ex5601-t1 Firmware
A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device.
CVE-2025-13942
Critical · 9.8
CWE-78 Feb 24, 2026
OS Command Injection in Zyxel Wx5610-b0 Firmware
A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.
CVE-2025-11848
Medium · 4.9
CWE-476 Feb 24, 2026
NULL Pointer Dereference in Zyxel Ex5601-t1 Firmware
A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
CVE-2025-11847
Medium · 4.9
CWE-476 Feb 24, 2026
NULL Pointer Dereference in Zyxel Ex3510-b1 Firmware
A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
CVE-2025-11846
Medium · 4.9
CWE-476 Feb 23, 2026
NULL Pointer Dereference in Zyxel Lte3301-plus Firmware
A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
CVE-2025-11845
Medium · 4.9
CWE-476 Feb 23, 2026
NULL Pointer Dereference in Zyxel Lte3301-plus Firmware
A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
CVE-2025-11730
High · 7.2
CWE-78 Feb 4, 2026
OS Command Injection in Zyxel ATP series firmware
A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command.
CVE-2025-8693
High · 8.8
CWE-78 Nov 17, 2025
OS Command Injection in Zyxel Dm4200-b0 Firmware
A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute operating system (OS) commands on an affected device.
CVE-2025-6599
High · 7.5
CWE-400 Nov 17, 2025
Uncontrolled Resource Consumption in Zyxel Lte3301-plus Firmware
An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service (DoS) attacks. Such attacks may temporarily block legitimate HTTP requests and partially disrupt access to the web management interface, while other networking services remain unaffected.