CISA KEV + NVD
Zyxel firewalls flaws exploited in the wild
6 Zyxel firewalls vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
In numbers
- 6 exploited flaws, listed from 3 Nov 2021 to 3 Dec 2024
- 1 used in ransomware campaigns
- 6 scored critical by NVD
- 12 days: median gap between NVD publication and the KEV listing, leaving out the 1 listed on the catalog’s first day; 2 were listed within a week
All exploited Zyxel firewalls flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2024-11667Zyxel Multiple Firewalls Path Traversal Vulnerability | Multiple Firewalls | 27 Nov 2024 | 3 Dec 20246 days laterUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2023-33010Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Multiple Firewalls | 24 May 2023 | 5 Jun 202312 days later | 9.8 Critical | Vendor |
| CVE-2023-33009Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Multiple Firewalls | 24 May 2023 | 5 Jun 202312 days later | 9.8 Critical | Vendor |
| CVE-2023-28771Zyxel Multiple Firewalls OS Command Injection Vulnerability | Multiple Firewalls | 25 Apr 2023 | 31 May 202336 days later | 9.8 Critical | Vendor |
| CVE-2022-30525Zyxel Multiple Firewalls OS Command Injection Vulnerability | Multiple Firewalls | 12 May 2022 | 16 May 20224 days later | 9.8 Critical | — |
| CVE-2020-29583Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability | Multiple Products | 22 Dec 2020 | 3 Nov 2021316 days later | 9.8 Critical | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.