Zyxel · EMG2926 Routers
CVE-2017-6884
Zyxel EMG2926 Routers Command Injection Vulnerability
What it is
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
CISA: Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 9, 2023
- Added to the CISA list
- September 18, 2023
- Published
- April 6, 2017
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 33% in the top 1.7% of all known vulnerabilities
- Weakness
- CWE-78
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Zyxel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 21, 2026 | Stack-Based Buffer Overflow | GS1900 Series Switches | High 8.8 | 2.8% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 21% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 23% |
| Dec 3, 2024 | Path Traversal | Multiple Firewalls | High 7.5 | 2.9% |
| Aug 7, 2023 | Command Injection | P660HN-T1A Routers | Critical 9.8 | 95% |
| Jun 23, 2023 | Multiple NAS Devices Command Injection | Multiple Network-Attached Storage (NAS) Devices | Critical 9.8 | 82% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 28% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 29% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.