CVE Program partner

Zyxel

Zyxel Corporation

API
CVEs, 365 days27166 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationZyxel Corporation
RoleCNA
TypeVendor
Reports tomitre
ScopeZyxel products issues only.
Advisorieshttps://www.zyxel.com/support/security_advisories.shtml

Latest CVEs · RSS

  • CVE-2026-14818 2026-08-04 · CVSS 7.2
    A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, US
  • CVE-2026-8508 2026-08-04 · CVSS 6.5
    An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker
  • CVE-2026-6837 2026-08-04 · CVSS 7.2
    A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an a
  • CVE-2026-6952 2026-07-21 · CVSS 7.2
    A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.
  • CVE-2026-7273 2026-06-16 · CVSS 8.8
    A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthen
  • CVE-2026-3871 2026-06-02 · CVSS 6.5
    A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent
  • CVE-2026-3870 2026-06-02 · CVSS 6.5
    A buffer overflow vulnerability in the UPnP AddPortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent at
  • CVE-2026-4795 2026-05-26 · CVSS 6.5
    A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.00(ACPT.2)C0,  GS1200
  • CVE-2026-7287 2026-05-12 · CVSS 7.5
    ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() function
  • CVE-2026-7257 2026-05-12 · CVSS 4.4
    ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(
  • CVE-2026-7256 2026-05-12 · CVSS 8.8
    ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacen
  • CVE-2026-7255 2026-05-12 · CVSS 6.5
    ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 f
  • CVE-2026-1460 2026-04-28 · CVSS 7.2
    A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware ver
  • CVE-2026-0711 2026-04-28 · CVSS 6.8
    A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an
  • CVE-2026-6058 2026-04-21 · CVSS 4.5
    ** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could all
  • CVE-2026-1459 2026-02-24 · CVSS 7.2
    A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(AB
  • CVE-2025-13943 2026-02-24 · CVSS 8.8
    A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could al
  • CVE-2025-13942 2026-02-24 · CVSS 9.8
    A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execu
  • CVE-2025-11848 2026-02-24 · CVSS 4.9
    A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100
  • CVE-2025-11847 2026-02-24 · CVSS 4.9
    A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX310
  • CVE-2025-11846 2026-02-24 · CVSS 4.9
    A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel
  • CVE-2025-11845 2026-02-24 · CVSS 4.9
    A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the
  • CVE-2025-11730 2026-02-05 · CVSS 7.2
    A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 throu
  • CVE-2025-8693 2025-11-18 · CVSS 8.8
    A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an au
  • CVE-2025-6599 2025-11-18 · CVSS 5.3
    An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to

All CVE Program partners