{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T03:54:42.456Z",
  "tag": {
    "id": "zyxel",
    "label": "Zyxel",
    "isStack": false,
    "url": "https://pwn.watch/t/zyxel",
    "feed": "https://pwn.watch/t/zyxel/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "zyxel-dsl-cpe-devices-cve-2024-40890",
      "title": "Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)",
      "url": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890",
      "json": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "unpatched",
      "product": "Zyxel DSL CPE Devices",
      "tags": [
        "zyxel",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-40890",
        "CVE-2024-40891"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "None: CISA says the product is end-of-life; discontinue use"
      ],
      "startedAt": "2025-02-11",
      "closedAt": "2025-02-11",
      "updatedAt": "2025-02-11",
      "summary": "CVE-2024-40890: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. CVE-2024-40891: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. Added to CISA KEV on 2025-02-11.",
      "xPost": null
    },
    {
      "slug": "zyxel-multiple-firewalls-cve-2024-11667",
      "title": "Zyxel Multiple Firewalls Path Traversal",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667",
      "json": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Zyxel Multiple Firewalls",
      "tags": [
        "zyxel",
        "firewall",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-11667"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-27",
      "closedAt": "2024-12-03",
      "updatedAt": "2024-12-03",
      "summary": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Added to the CISA KEV catalog on 2024-12-03. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "zyxel-multiple-network-attached-storage-nas-cve-2023-27992",
      "title": "Zyxel Multiple Network-Attached Storage (NAS) Devices: Command Injection (CVE-2023-27992)",
      "url": "https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992",
      "json": "https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Zyxel Multiple Network-Attached Storage (NAS) Devices",
      "tags": [
        "zyxel",
        "cisa-kev",
        "rce",
        "iot"
      ],
      "cveIds": [
        "CVE-2023-27992"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-06-23",
      "closedAt": "2023-06-23",
      "updatedAt": "2023-06-23",
      "summary": "Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request. Added to CISA KEV on 2023-06-23.",
      "xPost": null
    },
    {
      "slug": "zyxel-multiple-firewalls-cve-2023-33009-33010",
      "title": "Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010",
      "json": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Zyxel Multiple Firewalls",
      "tags": [
        "zyxel",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2023-33009",
        "CVE-2023-33010"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-06-05",
      "closedAt": "2023-06-05",
      "updatedAt": "2023-06-05",
      "summary": "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Added to CISA KEV on 2023-06-05.",
      "xPost": null
    },
    {
      "slug": "zyxel-multiple-firewalls-cve-2023-28771",
      "title": "Zyxel Multiple Firewalls: OS Command Injection (CVE-2023-28771)",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771",
      "json": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Zyxel Multiple Firewalls",
      "tags": [
        "zyxel",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2023-28771"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-05-31",
      "closedAt": "2023-05-31",
      "updatedAt": "2023-05-31",
      "summary": "Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. Added to CISA KEV on 2023-05-31.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "zyxel-dsl-cpe-devices-cve-2024-40890",
      "incidentTitle": "Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "unpatched",
      "date": "2025-02-11",
      "title": "CISA added CVE-2024-40890 to the KEV catalog (due 2025-03-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890"
    },
    {
      "incident": "zyxel-dsl-cpe-devices-cve-2024-40890",
      "incidentTitle": "Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "unpatched",
      "date": "2025-02-11",
      "title": "CISA added CVE-2024-40891 to the KEV catalog (due 2025-03-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890"
    },
    {
      "incident": "zyxel-multiple-firewalls-cve-2024-11667",
      "incidentTitle": "Zyxel Multiple Firewalls Path Traversal",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "CISA added CVE-2024-11667 to the KEV catalog (federal deadline 2024-12-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667"
    },
    {
      "incident": "zyxel-multiple-firewalls-cve-2024-11667",
      "incidentTitle": "Zyxel Multiple Firewalls Path Traversal",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-27",
      "title": "CVE-2024-11667 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-11667",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667"
    },
    {
      "incident": "zyxel-multiple-network-attached-storage-nas-cve-2023-27992",
      "incidentTitle": "Zyxel Multiple Network-Attached Storage (NAS) Devices: Command Injection (CVE-2023-27992)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-23",
      "title": "CISA added CVE-2023-27992 to the KEV catalog (due 2023-07-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992"
    },
    {
      "incident": "zyxel-multiple-firewalls-cve-2023-33009-33010",
      "incidentTitle": "Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-05",
      "title": "CISA added CVE-2023-33009 to the KEV catalog (due 2023-06-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010"
    },
    {
      "incident": "zyxel-multiple-firewalls-cve-2023-33009-33010",
      "incidentTitle": "Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-05",
      "title": "CISA added CVE-2023-33010 to the KEV catalog (due 2023-06-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010"
    },
    {
      "incident": "zyxel-multiple-firewalls-cve-2023-28771",
      "incidentTitle": "Zyxel Multiple Firewalls: OS Command Injection (CVE-2023-28771)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-31",
      "title": "CISA added CVE-2023-28771 to the KEV catalog (due 2023-06-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771"
    }
  ]
}