https://vulnogram.org/ Most recent CVEs assigned by Zyxel Corporation (zyxel). https://vulnogram.org/seaview/icons/zyxel.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-12489 https://vulnogram.org/CVE-2026-12489 An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected devi… Medium Tue, 20 Oct 2026 02:04:49 GMT https://vulnogram.org/CVE-2026-14818 https://vulnogram.org/CVE-2026-14818 A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50(W) series fi… High Tue, 04 Aug 2026 02:28:53 GMT https://vulnogram.org/CVE-2026-8508 https://vulnogram.org/CVE-2026-8508 An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication. Medium Tue, 04 Aug 2026 01:57:51 GMT https://vulnogram.org/CVE-2026-6837 https://vulnogram.org/CVE-2026-6837 A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected… High Tue, 04 Aug 2026 01:52:07 GMT https://vulnogram.org/CVE-2026-6952 https://vulnogram.org/CVE-2026-6952 A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow an authenticated attacker with administrator privileges to execute OS com… High Tue, 21 Jul 2026 02:00:01 GMT https://vulnogram.org/CVE-2026-7273 https://vulnogram.org/CVE-2026-7273 A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTT… High Known Exploited Tue, 16 Jun 2026 02:20:29 GMT https://vulnogram.org/CVE-2026-3871 https://vulnogram.org/CVE-2026-3871 A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent attacker to trigger a temporary denial-of-service (DoS) condition affecting the UPnP func… Medium Tue, 02 Jun 2026 02:04:17 GMT https://vulnogram.org/CVE-2026-3870 https://vulnogram.org/CVE-2026-3870 A buffer overflow vulnerability in the UPnP AddPortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent attacker to trigger a temporary denial-of-service (DoS) condition affecting the UPnP functio… Medium Tue, 02 Jun 2026 01:54:49 GMT https://vulnogram.org/CVE-2026-4795 https://vulnogram.org/CVE-2026-4795 A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.00(ACPT.2)C0, GS1200-5HPv3 firmware versions through 1.00(ACPU.2)C0, GS1200-8HPv3 firmware versions through 1.0… Medium Tue, 26 May 2026 01:42:37 GMT https://vulnogram.org/CVE-2026-7287 https://vulnogram.org/CVE-2026-7287 ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could… High Network Exploitable Unsupported When Assigned Tue, 12 May 2026 03:56:13 GMT https://vulnogram.org/CVE-2026-7257 https://vulnogram.org/CVE-2026-7257 ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow a local attacker with administrator privileges to download and decry… Medium Unsupported When Assigned Tue, 12 May 2026 03:31:02 GMT https://vulnogram.org/CVE-2026-7256 https://vulnogram.org/CVE-2026-7256 ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by… High Unsupported When Assigned Tue, 12 May 2026 03:25:32 GMT https://vulnogram.org/CVE-2026-7255 https://vulnogram.org/CVE-2026-7255 ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force… Medium Unsupported When Assigned Tue, 12 May 2026 03:22:18 GMT https://vulnogram.org/CVE-2026-1460 https://vulnogram.org/CVE-2026-1460 A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator pr… High Tue, 28 Apr 2026 02:06:22 GMT https://vulnogram.org/CVE-2026-0711 https://vulnogram.org/CVE-2026-0711 A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on a… Medium Tue, 28 Apr 2026 01:57:54 GMT https://vulnogram.org/CVE-2026-6058 https://vulnogram.org/CVE-2026-6058 ** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the WLAN to cause a denial-of-service (DoS) condition in the we… Medium Unsupported When Assigned Tue, 21 Apr 2026 01:42:07 GMT https://vulnogram.org/CVE-2026-1459 https://vulnogram.org/CVE-2026-1459 A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute o… High Tue, 24 Feb 2026 02:48:35 GMT https://vulnogram.org/CVE-2025-13943 https://vulnogram.org/CVE-2025-13943 A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected dev… High Tue, 24 Feb 2026 02:38:05 GMT https://vulnogram.org/CVE-2025-13942 https://vulnogram.org/CVE-2025-13942 A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP… Critical Network Exploitable Tue, 24 Feb 2026 02:32:18 GMT https://vulnogram.org/CVE-2025-11848 https://vulnogram.org/CVE-2025-11848 A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with… Medium Tue, 24 Feb 2026 02:14:18 GMT https://vulnogram.org/CVE-2025-11847 https://vulnogram.org/CVE-2025-11847 A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with… Medium Tue, 24 Feb 2026 02:09:44 GMT https://vulnogram.org/CVE-2025-11846 https://vulnogram.org/CVE-2025-11846 A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker… Medium Tue, 24 Feb 2026 01:37:57 GMT https://vulnogram.org/CVE-2025-11845 https://vulnogram.org/CVE-2025-11845 A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated at… Medium Tue, 24 Feb 2026 01:30:50 GMT https://vulnogram.org/CVE-2025-11730 https://vulnogram.org/CVE-2025-11730 A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) serie… High Thu, 05 Feb 2026 01:55:12 GMT https://vulnogram.org/CVE-2025-8693 https://vulnogram.org/CVE-2025-8693 A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute operating system (OS) commands on an affected device. High Tue, 18 Nov 2025 01:25:05 GMT https://vulnogram.org/CVE-2025-6599 https://vulnogram.org/CVE-2025-6599 An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service (DoS) attacks. Such attacks may temporarily blo… Medium Network Exploitable Tue, 18 Nov 2025 01:19:47 GMT https://vulnogram.org/CVE-2025-9133 https://vulnogram.org/CVE-2025-9133 A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN serie… High Tue, 21 Oct 2025 01:57:20 GMT https://vulnogram.org/CVE-2025-8078 https://vulnogram.org/CVE-2025-8078 A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and US… High Tue, 21 Oct 2025 01:49:29 GMT https://vulnogram.org/CVE-2025-7673 https://vulnogram.org/CVE-2025-7673 A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute ar… Critical Network Exploitable Wed, 16 Jul 2025 07:11:02 GMT https://vulnogram.org/CVE-2025-6265 https://vulnogram.org/CVE-2025-6265 A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such… High Tue, 15 Jul 2025 01:32:10 GMT https://vulnogram.org/CVE-2025-3577 https://vulnogram.org/CVE-2025-3577 **UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00(AAJC.16)C0 could allow an authenticated attacker with administrator privileges to access restricted directori… Medium Unsupported When Assigned Tue, 22 Apr 2025 02:18:58 GMT https://vulnogram.org/CVE-2025-1732 https://vulnogram.org/CVE-2025-1732 An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration… Medium Tue, 22 Apr 2025 01:57:35 GMT https://vulnogram.org/CVE-2025-1731 https://vulnogram.org/CVE-2025-1731 An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shel… High Tue, 22 Apr 2025 01:52:04 GMT https://vulnogram.org/CVE-2024-12010 https://vulnogram.org/CVE-2024-12010 A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating syst… High Tue, 11 Mar 2025 01:44:15 GMT https://vulnogram.org/CVE-2024-12009 https://vulnogram.org/CVE-2024-12009 A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) co… High Tue, 11 Mar 2025 01:37:54 GMT https://vulnogram.org/CVE-2024-11253 https://vulnogram.org/CVE-2024-11253 A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(ABOM.8.5)C0 and earlier could allow an authenticated attacker with administrator privileges… High Tue, 11 Mar 2025 01:29:00 GMT https://vulnogram.org/CVE-2025-0890 https://vulnogram.org/CVE-2025-0890 **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators h… Critical Network Exploitable Unsupported When Assigned Tue, 04 Feb 2025 10:06:56 GMT https://vulnogram.org/CVE-2024-40891 https://vulnogram.org/CVE-2024-40891 **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operatin… High Known Exploited Unsupported When Assigned Tue, 04 Feb 2025 10:02:48 GMT https://vulnogram.org/CVE-2024-40890 https://vulnogram.org/CVE-2024-40890 **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system… High Known Exploited Unsupported When Assigned Tue, 04 Feb 2025 09:55:38 GMT https://vulnogram.org/CVE-2024-12398 https://vulnogram.org/CVE-2024-12398 An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to… High Tue, 14 Jan 2025 01:39:04 GMT https://vulnogram.org/CVE-2024-9200 https://vulnogram.org/CVE-2024-9200 A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(ABQA.2.2)C0 could allow an authenticated attacker with administrator privileges to execute… High Tue, 03 Dec 2024 01:33:47 GMT https://vulnogram.org/CVE-2024-9197 https://vulnogram.org/CVE-2024-9197 A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)C0 could allow an authenticated attacker with administrator privileges to cause a temporar… Medium Tue, 03 Dec 2024 01:24:36 GMT https://vulnogram.org/CVE-2024-8748 https://vulnogram.org/CVE-2024-8748 A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0 could allow an attacker to cause a temporary denial of service (DoS) condition against the w… High Network Exploitable Tue, 03 Dec 2024 01:15:46 GMT https://vulnogram.org/CVE-2024-11667 https://vulnogram.org/CVE-2024-11667 A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG… High Known Exploited Network Exploitable Wed, 27 Nov 2024 09:39:41 GMT https://vulnogram.org/CVE-2024-11494 https://vulnogram.org/CVE-2024-11494 **UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an unauthenticated attacker to read some device information via a crafted HTTP HEAD method. High Network Exploitable Unsupported When Assigned Wed, 20 Nov 2024 09:36:06 GMT https://vulnogram.org/CVE-2024-8882 https://vulnogram.org/CVE-2024-8882 A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to cause denial of service (DoS) conditions v… Medium Tue, 12 Nov 2024 01:23:57 GMT https://vulnogram.org/CVE-2024-8881 https://vulnogram.org/CVE-2024-8881 A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operati… Medium Tue, 12 Nov 2024 01:17:36 GMT https://vulnogram.org/CVE-2024-9677 https://vulnogram.org/CVE-2024-9677 The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication… Medium Tue, 22 Oct 2024 01:19:53 GMT https://vulnogram.org/CVE-2024-38269 https://vulnogram.org/CVE-2024-38269 An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause… Medium Tue, 24 Sep 2024 01:38:14 GMT https://vulnogram.org/CVE-2024-38268 https://vulnogram.org/CVE-2024-38268 An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause poten… Medium Tue, 24 Sep 2024 01:35:22 GMT