29
CVEs
2
Critical
13
High
0
KEV
1
PoC
15
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
13
MEDIUM
14
LOW
0
Monthly CVE Trend
Affected Products (30)
Gs1900 10Hp Firmware
34
Usg Flex 200 Firmware
27
Usg Flex 500 Firmware
27
Usg Flex 700 Firmware
27
Usg Flex 100W Firmware
27
Usg Flex 100 Firmware
25
Nas326 Firmware
23
Vpn50 Firmware
21
Vpn100 Firmware
21
Vpn300 Firmware
21
Usg Flex 50W Firmware
20
Vpn1000 Firmware
20
Zld
19
Usg 20W Vpn Firmware
19
Emg3525 T50b Firmware
18
Atp500 Firmware
18
Vmg3625 T50b Firmware
18
Usg Flex 50 Firmware
18
Atp800 Firmware
18
Emg5523 T50b Firmware
18
Atp200 Firmware
18
Vmg8623 T50b Firmware
18
Atp100 Firmware
17
Nas542 Firmware
17
Pm7300 T0 Firmware
16
Ex3510 B0 Firmware
16
Gs1900 8 Firmware
16
Atp100W Firmware
16
Ax7501 B1 Firmware
16
Atp700 Firmware
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-13206 | OS command injection in the Zyxel WAH7601 4G/LTE CPE router lets an attacker inject arbitrary operating-system commands through improperly neutralized input, affecting all firmware builds up to and including version 20072026. Successful exploitation yields full command execution on the device with high confidentiality, integrity, and availability impact, per the TR-CERT-assigned CVSS 9.8 rating. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, so risk is currently theoretical-but-severe rather than confirmed active exploitation. | CRITICAL | 9.8 | 1.3% | 50 |
No patch
|
| CVE-2025-13942 | Command injection in Zyxel EX3510-B0 router UPnP functionality via firmware versions through 5.17. Allows remote code execution through the UPnP service. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-7256 | Command injection in Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0 allows unauthenticated adjacent network attackers to execute arbitrary operating system commands via crafted HTTP requests to the CGI interface. This vulnerability affects an end-of-life product with no vendor support, meaning no security patches will be released. Exploitation requires adjacent network access (same LAN segment) but no authentication, making it exploitable by any device on the local network including compromised IoT devices or malicious insiders. | HIGH | 8.8 | 0.8% | 45 |
No patch
|
| CVE-2026-7273 | Remote code execution in Zyxel GS1900 series managed switches (including GS1900-48HPv2, GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24/24E/24EP/24HPv2, and GS1900-48) up to firmware 2.90(ABTQ.1)C0 allows a LAN-adjacent unauthenticated attacker to execute OS commands via a crafted HTTP request to the CGI handler. The flaw is a stack-based buffer overflow (CWE-121) carrying CVSS 8.8 and exposes the switch management plane to anyone on the same Layer-2 segment. No public exploit identified at time of analysis, but the vendor disclosed the issue concurrently with the advisory dated 2026-06-16. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2025-13943 | A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-12984 | Insufficiently protected credentials in the Zyxel WAH7601 4G LTE mobile Wi-Fi router expose sensitive embedded data to unauthenticated remote attackers. All firmware versions through 20072026 are affected, and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation requiring no privileges or user interaction. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated network-accessible nature of the flaw warrants prompt patching. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-7287 | Remote unauthenticated attackers can crash Zyxel NWA1100-N access points running customized firmware version 1.00(AACE.1)C0 by sending malformed HTTP requests that trigger buffer overflows in five distinct web server functions (formWep, formWlAc, formPasswordSetup, formUpgradeCert, formDelcert). The vulnerability enables denial-of-service attacks with high CVSS 7.5 severity but is limited to an end-of-life product according to Zyxel's reference documentation. No public exploit code identified at time of analysis, and EPSS data is unavailable for this recent CVE. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-6952 | OS command injection in the Zyxel AX7501-B1 fiber ONT/CPE allows an authenticated administrator to run arbitrary operating-system commands by injecting shell metacharacters into the "LogServer" field of the device's syslog configuration. All firmware up to and including 5.17(ABPC.7.2)C0 is affected, and successful exploitation yields full command execution on the device (CVSS 7.2, PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 7.2 | 0.9% | 37 |
No patch
|
| CVE-2026-6837 | Command injection in the Zyxel WAX650S Wi-Fi 6 access point firmware enables an authenticated administrator to execute arbitrary OS commands via the "export-cgi" CGI program. All firmware versions through 7.10(ABRM.4)C0 are affected, with full confidentiality, integrity, and availability impact on the device. No public exploit has been identified at time of analysis, and exploitation is gated behind administrator-level credentials, constraining real-world risk to insider threat or post-credential-compromise scenarios. | HIGH | 7.2 | 0.9% | 37 |
No patch
|
| CVE-2026-6374 | Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the device executable, enabling adjacent-network attackers without any prior privileges to bypass authentication and achieve high-impact confidentiality and integrity compromise. All WAH7601 firmware versions through 20.07.2026 are confirmed affected per TR-CERT advisory TR-26-0799 and NVD. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity characteristic of CWE-798 makes this a credible near-term risk in environments where adjacent access is not tightly controlled. | HIGH | 7.3 | 0.2% | 37 |
No patch
|
| CVE-2026-14818 | Path traversal in Zyxel's ZLD-based firewall firmware (ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series) allows an authenticated administrator to supply a crafted configuration file path to the CLI execution command, bypassing directory restrictions and achieving arbitrary code execution on the device. All four product lines share the same vulnerable CLI mechanism across wide firmware version ranges, substantially broadening the attack surface for organizations running unpatched appliances. No public exploit or CISA KEV listing has been identified at time of analysis, limiting immediate real-world risk to scenarios involving credential compromise or insider threat. | HIGH | 7.2 | 0.4% | 36 |
No patch
|
| CVE-2025-11730 | A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.3% | 36 |
PoC
No patch
|
| CVE-2026-1460 | Command injection in Zyxel DX3301-T0 and EX3301-T0 routers allows authenticated administrators to execute arbitrary OS commands by injecting malicious input into the DomainName parameter of DHCP configuration. Affects firmware versions through 5.50(ABVY.7.1)C0. Vendor Zyxel has published a security advisory with remediation guidance. EPSS data not available; no public exploit identified at time of analysis. While CVSS score is 7.2 (High), practical risk is constrained by requirement for admin-level authentication, limiting exposure to credential compromise or malicious insider scenarios. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-1459 | Zyxel VMG3625-T50B, DX5401 B1, and EMG5523 T50B devices with firmware through version 5.50(ABPM.9.7)C0 contain a post-authentication command injection vulnerability in the TR-369 certificate download function that allows authenticated administrators to execute arbitrary operating system commands. An attacker with admin credentials could leverage this to gain complete control over the affected device. No patch is currently available. | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2026-0711 | Command injection in EasyMesh APIs of Zyxel DX3300-T0 firmware through version 5.50(ABVY.7.1)C0 allows authenticated administrators with adjacent network access to execute arbitrary OS commands on the device. The vulnerability requires both administrator privileges and adjacent network positioning (AV:A), significantly limiting exposure to local network attackers rather than remote threat actors. CVSS 6.8 reflects high confidentiality, integrity, and availability impact but is constrained by elevated privilege and adjacency requirements. | MEDIUM | 6.8 | 0.2% | 34 |
No patch
|