https://patchfirst.co/vendor/zyxel/New and newly exploited Zyxel CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMThttps://patchfirst.co/cve/CVE-2026-7273/CVE-2026-7273#kevMon, 21 Sep 2026 00:00:00 GMTZyxel · GS1900 Series Switches. In CISA KEV since 2026-09-21. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 76.4 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2025-7673/CVE-2025-7673Wed, 16 Jul 2025 00:00:00 GMTZyxel · VMG8825-T50K firmware. Not in CISA KEV. EPSS 0.7% (higher than 51.2% of CVEs). CVSS 9.8 CRITICAL. Priority 52.1 of 100.https://patchfirst.co/cve/CVE-2024-40891/CVE-2024-40891#kevTue, 11 Feb 2025 00:00:00 GMTZyxel · DSL CPE Devices. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 22.9% (higher than 97.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1055 Process Injection; T1011 Exfiltration Over Other Network Medium. Priority 68.7 of 100.kevpublic-exploitT1055T1011https://patchfirst.co/cve/CVE-2024-40890/CVE-2024-40890#kevTue, 11 Feb 2025 00:00:00 GMTZyxel · DSL CPE Devices. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 20.7% (higher than 97.5% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1055 Process Injection; T1011 Exfiltration Over Other Network Medium. Priority 63.7 of 100.kevT1055T1011https://patchfirst.co/cve/CVE-2025-0890/CVE-2025-0890Tue, 04 Feb 2025 00:00:00 GMTZyxel · VMG4325-B10A firmware. Not in CISA KEV. EPSS 14.4% (higher than 96.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 71.2 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-11667/CVE-2024-11667#kevTue, 03 Dec 2024 00:00:00 GMTZyxel · Multiple Firewalls. In CISA KEV since 2024-12-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 2.9% (higher than 87.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1105 Ingress Tool Transfer. Priority 72.3 of 100.kevransomwareT1190T1005T1105https://patchfirst.co/cve/CVE-2024-42057/CVE-2024-42057Tue, 03 Sep 2024 00:00:00 GMTZyxel · ATP series firmware. Not in CISA KEV. EPSS 1.3% (higher than 70.8% of CVEs). CVSS 8.1 HIGH. Priority 66.2 of 100.https://patchfirst.co/cve/CVE-2024-29973/CVE-2024-29973Tue, 04 Jun 2024 00:00:00 GMTZyxel · NAS326 firmware. Not in CISA KEV. EPSS 86.2% (higher than 99.73% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 69.2 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-29972/CVE-2024-29972Tue, 04 Jun 2024 00:00:00 GMTZyxel · NAS326 firmware. Not in CISA KEV. EPSS 90.3% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 66.8 of 100.public-exploithttps://patchfirst.co/cve/CVE-2023-4473/CVE-2023-4473Thu, 30 Nov 2023 00:00:00 GMTZyxel · NAS326 firmware. Not in CISA KEV. EPSS 41.3% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Priority 62.7 of 100.https://patchfirst.co/cve/CVE-2023-4474/CVE-2023-4474Thu, 30 Nov 2023 00:00:00 GMTZyxel · NAS326 firmware. Not in CISA KEV. EPSS 29.7% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Priority 61.5 of 100.https://patchfirst.co/cve/CVE-2023-37928/CVE-2023-37928Thu, 30 Nov 2023 00:00:00 GMTZyxel · NAS326 firmware. Not in CISA KEV. EPSS 60.2% (higher than 99.13% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.https://patchfirst.co/cve/CVE-2017-6884/CVE-2017-6884#kevMon, 18 Sep 2023 00:00:00 GMTZyxel · EMG2926 Routers. In CISA KEV since 2023-09-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 33.0% (higher than 98.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.8 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2017-18368/CVE-2017-18368#kevMon, 07 Aug 2023 00:00:00 GMTZyxel · P660HN-T1A Routers. In CISA KEV since 2023-08-07. ENISA EUVD lists it as exploited. EPSS 94.5% (higher than 99.85% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2023-27992/CVE-2023-27992#kevFri, 23 Jun 2023 00:00:00 GMTZyxel · Multiple Network-Attached Storage (NAS) Devices. In CISA KEV since 2023-06-23. ENISA EUVD lists it as exploited. EPSS 82.3% (higher than 99.66% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 64.8 of 100.kevT1190T1059https://patchfirst.co/cve/CVE-2023-33010/CVE-2023-33010#kevMon, 05 Jun 2023 00:00:00 GMTZyxel · Multiple Firewalls. In CISA KEV since 2023-06-05. ENISA EUVD lists it as exploited. EPSS 29.0% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.5 of 100.kevT1190T1059T1499.004https://patchfirst.co/cve/CVE-2023-33009/CVE-2023-33009#kevMon, 05 Jun 2023 00:00:00 GMTZyxel · Multiple Firewalls. In CISA KEV since 2023-06-05. ENISA EUVD lists it as exploited. EPSS 28.1% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.5 of 100.kevT1190T1059T1499.004https://patchfirst.co/cve/CVE-2023-28771/CVE-2023-28771#kevWed, 31 May 2023 00:00:00 GMTZyxel · Multiple Firewalls. In CISA KEV since 2023-05-31. ENISA EUVD lists it as exploited. EPSS 99.3% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2023-28769/CVE-2023-28769Thu, 27 Apr 2023 00:00:00 GMTZyxel · DX5401-B0 firmware. Not in CISA KEV. EPSS 5.4% (higher than 92.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 65.4 of 100.public-exploithttps://patchfirst.co/cve/CVE-2023-28770/CVE-2023-28770Thu, 27 Apr 2023 00:00:00 GMTZyxel · DX5401-B0 firmware. Not in CISA KEV. EPSS 57.8% (higher than 99.08% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 65.1 of 100.public-exploithttps://patchfirst.co/cve/CVE-2022-45440/CVE-2022-45440Tue, 17 Jan 2023 00:00:00 GMTZyxel · AX7501-B0 firmware. Not in CISA KEV. EPSS 0.2% (higher than 16.3% of CVEs). CVSS 4.4 MEDIUM. Priority 41.3 of 100.https://patchfirst.co/cve/CVE-2022-30525/CVE-2022-30525#kevMon, 16 May 2022 00:00:00 GMTZyxel · Multiple Firewalls. In CISA KEV since 2022-05-16. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 2 threat reports. Priority 86.0 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2022-0342/CVE-2022-0342Mon, 28 Mar 2022 00:00:00 GMTZyxel · USG/ZyWALL series firmware. Not in CISA KEV. EPSS 95.1% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 67.5 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-9054/CVE-2020-9054#kevFri, 25 Mar 2022 00:00:00 GMTZyxel · Multiple Network-Attached Storage (NAS) Devices. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2021-4039/CVE-2021-4039Tue, 01 Mar 2022 00:00:00 GMTZyxel · NWA1100-NH firmware. Not in CISA KEV. EPSS 71.0% (higher than 99.4% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 68.9 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-29583/CVE-2020-29583#kevWed, 03 Nov 2021 00:00:00 GMTZyxel · Multiple Products. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 90.2% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts. Priority 69.8 of 100.kevpublic-exploitT1078