8
CVEs
1
Critical
5
High
0
KEV
0
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
5
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Gs1900 10Hp Firmware
34
Usg Flex 200 Firmware
27
Usg Flex 500 Firmware
27
Usg Flex 700 Firmware
27
Usg Flex 100W Firmware
27
Usg Flex 100 Firmware
25
Nas326 Firmware
23
Vpn50 Firmware
21
Vpn100 Firmware
21
Vpn300 Firmware
21
Usg Flex 50W Firmware
20
Vpn1000 Firmware
20
Zld
19
Usg 20W Vpn Firmware
19
Emg3525 T50b Firmware
18
Atp500 Firmware
18
Vmg3625 T50b Firmware
18
Usg Flex 50 Firmware
18
Atp800 Firmware
18
Emg5523 T50b Firmware
18
Atp200 Firmware
18
Vmg8623 T50b Firmware
18
Atp100 Firmware
17
Nas542 Firmware
17
Pm7300 T0 Firmware
16
Ex3510 B0 Firmware
16
Gs1900 8 Firmware
16
Atp100W Firmware
16
Ax7501 B1 Firmware
16
Atp700 Firmware
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-13206 | OS command injection in the Zyxel WAH7601 4G/LTE CPE router lets an attacker inject arbitrary operating-system commands through improperly neutralized input, affecting all firmware builds up to and including version 20072026. Successful exploitation yields full command execution on the device with high confidentiality, integrity, and availability impact, per the TR-CERT-assigned CVSS 9.8 rating. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, so risk is currently theoretical-but-severe rather than confirmed active exploitation. | CRITICAL | 9.8 | 1.3% | 50 |
No patch
|
| CVE-2026-12984 | Insufficiently protected credentials in the Zyxel WAH7601 4G LTE mobile Wi-Fi router expose sensitive embedded data to unauthenticated remote attackers. All firmware versions through 20072026 are affected, and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation requiring no privileges or user interaction. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated network-accessible nature of the flaw warrants prompt patching. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-6952 | OS command injection in the Zyxel AX7501-B1 fiber ONT/CPE allows an authenticated administrator to run arbitrary operating-system commands by injecting shell metacharacters into the "LogServer" field of the device's syslog configuration. All firmware up to and including 5.17(ABPC.7.2)C0 is affected, and successful exploitation yields full command execution on the device (CVSS 7.2, PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 7.2 | 0.9% | 37 |
No patch
|
| CVE-2026-6837 | Command injection in the Zyxel WAX650S Wi-Fi 6 access point firmware enables an authenticated administrator to execute arbitrary OS commands via the "export-cgi" CGI program. All firmware versions through 7.10(ABRM.4)C0 are affected, with full confidentiality, integrity, and availability impact on the device. No public exploit has been identified at time of analysis, and exploitation is gated behind administrator-level credentials, constraining real-world risk to insider threat or post-credential-compromise scenarios. | HIGH | 7.2 | 0.9% | 37 |
No patch
|
| CVE-2026-6374 | Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the device executable, enabling adjacent-network attackers without any prior privileges to bypass authentication and achieve high-impact confidentiality and integrity compromise. All WAH7601 firmware versions through 20.07.2026 are confirmed affected per TR-CERT advisory TR-26-0799 and NVD. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity characteristic of CWE-798 makes this a credible near-term risk in environments where adjacent access is not tightly controlled. | HIGH | 7.3 | 0.2% | 37 |
No patch
|
| CVE-2026-14818 | Path traversal in Zyxel's ZLD-based firewall firmware (ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series) allows an authenticated administrator to supply a crafted configuration file path to the CLI execution command, bypassing directory restrictions and achieving arbitrary code execution on the device. All four product lines share the same vulnerable CLI mechanism across wide firmware version ranges, substantially broadening the attack surface for organizations running unpatched appliances. No public exploit or CISA KEV listing has been identified at time of analysis, limiting immediate real-world risk to scenarios involving credential compromise or insider threat. | HIGH | 7.2 | 0.4% | 36 |
No patch
|
| CVE-2026-8508 | Captive portal authentication bypass in Zyxel WAX650S firmware exposes guest or restricted wireless networks to unauthorized access by any WLAN-adjacent attacker. The flaw resides in the social_login.cgi CGI handler, where CWE-287 (Improper Authentication) allows requests to circumvent captive portal enforcement entirely - not just weaken it. All firmware versions through 7.10(ABRM.4)C0 are confirmed affected per the vendor's own advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation plausible once the mechanism is understood. | MEDIUM | 6.5 | 0.5% | 33 |
No patch
|
| CVE-2026-6373 | Sensitive system information exposure in the Zyxel WAH7601 portable 4G LTE mobile hotspot allows unauthenticated adjacent-network attackers to fingerprint the device's web application and firmware stack without any credentials. All firmware versions through 20072026 are affected per CPE data, and the CWE-497 root cause indicates the device's web interface leaks system-identifying data to any party on the adjacent network. No public exploit code or CISA KEV active exploitation has been identified at time of analysis, but the no-authentication, adjacent-network vector makes this trivially reachable by anyone connected to or physically proximate to the hotspot. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|