Firewalls, VPNs and routers

Zyxel security incident history

Updated Oct 26, 2026. Data gathered daily from official public sources.

As of Oct 26, 2026, Vendor History found 13 actively exploited security flaws for Zyxel, dated Nov 3, 2021 to Sep 21, 2026. Sources checked: the California and Washington Attorney General breach lists and CISA's Known Exploited Vulnerabilities catalog.

Breach notices and SEC cyber filings

None found in the sources we check.

Got a breach letter from Zyxel? What to do when a vendor has a data breach.

Actively exploited security flaws

Flaws in Zyxel products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.

1. Sep 21, 2026Exploited flaw

   Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (CVE-2026-7273). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

2. Feb 11, 2025Exploited flaw

   Zyxel DSL CPE OS Command Injection Vulnerability (CVE-2024-40890). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

3. Feb 11, 2025Exploited flaw

   Zyxel DSL CPE OS Command Injection Vulnerability (CVE-2024-40891). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

4. Dec 3, 2024Exploited flaw

   Zyxel Multiple Firewalls Path Traversal Vulnerability (CVE-2024-11667). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

5. Sep 18, 2023Exploited flaw

   Zyxel EMG2926 Routers Command Injection Vulnerability (CVE-2017-6884). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

6. Aug 7, 2023Exploited flaw

   Zyxel P660HN-T1A Routers Command Injection Vulnerability (CVE-2017-18368). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

7. Jun 23, 2023Exploited flaw

   Zyxel Multiple NAS Devices Command Injection Vulnerability (CVE-2023-27992). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

8. Jun 5, 2023Exploited flaw

   Zyxel Multiple Firewalls Buffer Overflow Vulnerability (CVE-2023-33009). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

9. Jun 5, 2023Exploited flaw

   Zyxel Multiple Firewalls Buffer Overflow Vulnerability (CVE-2023-33010). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

10. May 31, 2023Exploited flaw

    Zyxel Multiple Firewalls OS Command Injection Vulnerability (CVE-2023-28771). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

11. May 16, 2022Exploited flaw

    Zyxel Multiple Firewalls OS Command Injection Vulnerability (CVE-2022-30525). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

12. Mar 25, 2022Exploited flaw

    Zyxel Multiple NAS Devices OS Command Injection Vulnerability (CVE-2020-9054). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

13. Nov 3, 2021Exploited flaw

    Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability (CVE-2020-29583). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works

To cite: Vendor History, "Zyxel security incident history," vendorhistory.com/vendor/zyxel, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.