Sourced tracker
Zyxel router vulnerabilities exploited in the wild
4 Zyxel flaws that CISA lists as actively exploited, with what Zyxel says about each: the firmware that fixes it, or that the model is retired and will not be patched.
Exploited Zyxel flaws, newest first
| Vulnerability | Added to KEV | Vendor status and models | Source |
|---|---|---|---|
| CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability | 11 Feb 2025 | Replace: no fixVMG1312-B10A, VMG1312-B10B, VMG1312-B10E, VMG3312-B10A, VMG3313-B10A, VMG3926-B10B, VMG4325-B10A, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, SBG3300, SBG3500 | VendorRead 18 Oct 2026 |
| CVE-2024-40890Zyxel DSL CPE OS Command Injection Vulnerability | 11 Feb 2025 | Replace: no fixVMG1312-B10A, VMG1312-B10B, VMG1312-B10E, VMG3312-B10A, VMG3313-B10A, VMG3926-B10B, VMG4325-B10A, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, SBG3300, SBG3500 | VendorRead 18 Oct 2026 |
| CVE-2017-6884Zyxel EMG2926 Routers Command Injection Vulnerability | 18 Sep 2023Used in ransomware | Replace: no fixEMG2926-Q10A | VendorRead 18 Oct 2026 |
| CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability | 7 Aug 2023 | Replace: no fixP660HN-T1A | VendorRead 18 Oct 2026 |
Is your Zyxel model still supported?
Zyxel's end-of-life page; models retired more than three years ago are in an archived table linked from it.
Zyxel end-of-life list Read 18 Oct 2026
What to do
- Find the model and hardware version on the label under the router.
- If the row says fixed, install that firmware or newer from Zyxel’s own support site.
- If it says replace, the vendor will not patch it: a router exposed to the internet with a flaw attackers already use should be taken offline and replaced.
- Turn off remote management from the internet unless you need it.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. We copy CISA’s entry and re-check the catalog every week.
- The vendor status comes from the vendor’s own advisory or end-of-life notice, tied to a short sentence on that page that a script re-reads weekly.
- “Replace: no fix” means the vendor has said the model will not be patched. A router in that state stays open to the flaw for as long as it is online.
- Check the exact model and hardware version on the label under the router; vendors often fix one hardware version and retire another.
Other brands: ASUS · Cisco Small Business · D-Link · DrayTek · MikroTik · NETGEAR · Tenda · TP-Link · Ubiquiti · All routers