Zyxel
- Exploited flaws
- 13in 7 products
- Added to CISA's list in 2026
- 12 in 2025
- Used by ransomware
- 2of 13, says CISA
- Disclosure to CISA's list
- 12 daysmedian; 7 of 12 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2017 | 2 |
| 2018 | 0 |
| 2019 | 0 |
| 2020 | 2 |
| 2021 | 0 |
| 2022 | 1 |
| 2023 | 4 |
| 2024 | 3 |
| 2025 | 0 |
| 2026 | 1 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Multiple Firewalls | 5 | 2022-05-16 | 2024-12-03 |
| DSL CPE Devices | 2 | 2025-02-11 | 2025-02-11 |
| Multiple Network-Attached Storage (NAS) Devices | 2 | 2022-03-25 | 2023-06-23 |
Latest on CISA's list
- Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- Zyxel DSL CPE OS Command Injection Vulnerability
- Zyxel DSL CPE OS Command Injection Vulnerability
- Zyxel Multiple Firewalls Path Traversal Vulnerability
- Zyxel EMG2926 Routers Command Injection Vulnerability
- Zyxel P660HN-T1A Routers Command Injection Vulnerability
- Zyxel Multiple NAS Devices Command Injection Vulnerability
- Zyxel Multiple Firewalls Buffer Overflow Vulnerability
- Zyxel Multiple Firewalls Buffer Overflow Vulnerability
- Zyxel Multiple Firewalls OS Command Injection Vulnerability
In the news
No security story in the last 14 days named Zyxel in its headline.
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.