19
CVEs
1
Critical
9
High
0
KEV
0
PoC
10
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
9
MEDIUM
9
LOW
0
Monthly CVE Trend
Affected Products (30)
Gs1900 10Hp Firmware
34
Usg Flex 200 Firmware
27
Usg Flex 500 Firmware
27
Usg Flex 700 Firmware
27
Usg Flex 100W Firmware
27
Usg Flex 100 Firmware
25
Nas326 Firmware
23
Vpn50 Firmware
21
Vpn100 Firmware
21
Vpn300 Firmware
21
Usg Flex 50W Firmware
20
Vpn1000 Firmware
20
Zld
19
Usg 20W Vpn Firmware
19
Emg3525 T50b Firmware
18
Atp500 Firmware
18
Vmg3625 T50b Firmware
18
Usg Flex 50 Firmware
18
Atp800 Firmware
18
Emg5523 T50b Firmware
18
Atp200 Firmware
18
Vmg8623 T50b Firmware
18
Atp100 Firmware
17
Nas542 Firmware
17
Pm7300 T0 Firmware
16
Ex3510 B0 Firmware
16
Gs1900 8 Firmware
16
Atp100W Firmware
16
Ax7501 B1 Firmware
16
Atp700 Firmware
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-13206 | OS command injection in the Zyxel WAH7601 4G/LTE CPE router lets an attacker inject arbitrary operating-system commands through improperly neutralized input, affecting all firmware builds up to and including version 20072026. Successful exploitation yields full command execution on the device with high confidentiality, integrity, and availability impact, per the TR-CERT-assigned CVSS 9.8 rating. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, so risk is currently theoretical-but-severe rather than confirmed active exploitation. | CRITICAL | 9.8 | 1.3% | 50 |
No patch
|
| CVE-2026-7256 | Command injection in Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0 allows unauthenticated adjacent network attackers to execute arbitrary operating system commands via crafted HTTP requests to the CGI interface. This vulnerability affects an end-of-life product with no vendor support, meaning no security patches will be released. Exploitation requires adjacent network access (same LAN segment) but no authentication, making it exploitable by any device on the local network including compromised IoT devices or malicious insiders. | HIGH | 8.8 | 0.8% | 45 |
No patch
|
| CVE-2026-7273 | Remote code execution in Zyxel GS1900 series managed switches (including GS1900-48HPv2, GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24/24E/24EP/24HPv2, and GS1900-48) up to firmware 2.90(ABTQ.1)C0 allows a LAN-adjacent unauthenticated attacker to execute OS commands via a crafted HTTP request to the CGI handler. The flaw is a stack-based buffer overflow (CWE-121) carrying CVSS 8.8 and exposes the switch management plane to anyone on the same Layer-2 segment. No public exploit identified at time of analysis, but the vendor disclosed the issue concurrently with the advisory dated 2026-06-16. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-12984 | Insufficiently protected credentials in the Zyxel WAH7601 4G LTE mobile Wi-Fi router expose sensitive embedded data to unauthenticated remote attackers. All firmware versions through 20072026 are affected, and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation requiring no privileges or user interaction. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated network-accessible nature of the flaw warrants prompt patching. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-7287 | Remote unauthenticated attackers can crash Zyxel NWA1100-N access points running customized firmware version 1.00(AACE.1)C0 by sending malformed HTTP requests that trigger buffer overflows in five distinct web server functions (formWep, formWlAc, formPasswordSetup, formUpgradeCert, formDelcert). The vulnerability enables denial-of-service attacks with high CVSS 7.5 severity but is limited to an end-of-life product according to Zyxel's reference documentation. No public exploit code identified at time of analysis, and EPSS data is unavailable for this recent CVE. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-6952 | OS command injection in the Zyxel AX7501-B1 fiber ONT/CPE allows an authenticated administrator to run arbitrary operating-system commands by injecting shell metacharacters into the "LogServer" field of the device's syslog configuration. All firmware up to and including 5.17(ABPC.7.2)C0 is affected, and successful exploitation yields full command execution on the device (CVSS 7.2, PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 7.2 | 0.9% | 37 |
No patch
|
| CVE-2026-6837 | Command injection in the Zyxel WAX650S Wi-Fi 6 access point firmware enables an authenticated administrator to execute arbitrary OS commands via the "export-cgi" CGI program. All firmware versions through 7.10(ABRM.4)C0 are affected, with full confidentiality, integrity, and availability impact on the device. No public exploit has been identified at time of analysis, and exploitation is gated behind administrator-level credentials, constraining real-world risk to insider threat or post-credential-compromise scenarios. | HIGH | 7.2 | 0.9% | 37 |
No patch
|
| CVE-2026-6374 | Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the device executable, enabling adjacent-network attackers without any prior privileges to bypass authentication and achieve high-impact confidentiality and integrity compromise. All WAH7601 firmware versions through 20.07.2026 are confirmed affected per TR-CERT advisory TR-26-0799 and NVD. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity characteristic of CWE-798 makes this a credible near-term risk in environments where adjacent access is not tightly controlled. | HIGH | 7.3 | 0.2% | 37 |
No patch
|
| CVE-2026-14818 | Path traversal in Zyxel's ZLD-based firewall firmware (ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series) allows an authenticated administrator to supply a crafted configuration file path to the CLI execution command, bypassing directory restrictions and achieving arbitrary code execution on the device. All four product lines share the same vulnerable CLI mechanism across wide firmware version ranges, substantially broadening the attack surface for organizations running unpatched appliances. No public exploit or CISA KEV listing has been identified at time of analysis, limiting immediate real-world risk to scenarios involving credential compromise or insider threat. | HIGH | 7.2 | 0.4% | 36 |
No patch
|
| CVE-2026-1460 | Command injection in Zyxel DX3301-T0 and EX3301-T0 routers allows authenticated administrators to execute arbitrary OS commands by injecting malicious input into the DomainName parameter of DHCP configuration. Affects firmware versions through 5.50(ABVY.7.1)C0. Vendor Zyxel has published a security advisory with remediation guidance. EPSS data not available; no public exploit identified at time of analysis. While CVSS score is 7.2 (High), practical risk is constrained by requirement for admin-level authentication, limiting exposure to credential compromise or malicious insider scenarios. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-0711 | Command injection in EasyMesh APIs of Zyxel DX3300-T0 firmware through version 5.50(ABVY.7.1)C0 allows authenticated administrators with adjacent network access to execute arbitrary OS commands on the device. The vulnerability requires both administrator privileges and adjacent network positioning (AV:A), significantly limiting exposure to local network attackers rather than remote threat actors. CVSS 6.8 reflects high confidentiality, integrity, and availability impact but is constrained by elevated privilege and adjacency requirements. | MEDIUM | 6.8 | 0.2% | 34 |
No patch
|
| CVE-2026-8508 | Captive portal authentication bypass in Zyxel WAX650S firmware exposes guest or restricted wireless networks to unauthorized access by any WLAN-adjacent attacker. The flaw resides in the social_login.cgi CGI handler, where CWE-287 (Improper Authentication) allows requests to circumvent captive portal enforcement entirely - not just weaken it. All firmware versions through 7.10(ABRM.4)C0 are confirmed affected per the vendor's own advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation plausible once the mechanism is understood. | MEDIUM | 6.5 | 0.5% | 33 |
No patch
|
| CVE-2026-6373 | Sensitive system information exposure in the Zyxel WAH7601 portable 4G LTE mobile hotspot allows unauthenticated adjacent-network attackers to fingerprint the device's web application and firmware stack without any credentials. All firmware versions through 20072026 are affected per CPE data, and the CWE-497 root cause indicates the device's web interface leaks system-identifying data to any party on the adjacent network. No public exploit code or CISA KEV active exploitation has been identified at time of analysis, but the no-authentication, adjacent-network vector makes this trivially reachable by anyone connected to or physically proximate to the hotspot. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-4795 | Missing authorization in Zyxel GS1200v3-series managed switches allows a LAN-based, unauthenticated attacker to read system configuration data from a log file by sending a crafted HTTP request to the device's web interface. All five GS1200v3 models are affected across their current firmware versions. No public exploit has been identified at time of analysis, and both EPSS (0.03%, 11th percentile) and SSVC exploitation status ('none') confirm no observed in-the-wild exploitation, placing this in the category of a real but low-urgency information disclosure risk confined to the local network segment. | MEDIUM | 6.5 | 0.0% | 33 |
No patch
|
| CVE-2026-7255 | Brute-force password attacks against the web management interface of Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0 succeed due to improper rate-limiting on authentication attempts, allowing adjacent LAN attackers to bypass authentication and gain administrative access without requiring valid credentials. The vulnerability affects a legacy wireless range extender model marked as end-of-life by Zyxel, with CVSS 6.5 reflecting high confidentiality impact but local network scope. | MEDIUM | 6.5 | 0.0% | 33 |
No patch
|