VendorsEdge

Zyxel

Zyxel Networks makes ATP, USG FLEX and ZyWALL firewalls, NAS devices, DSL, 4G/5G and fiber CPE routers, wireless access points and switches.

Response trend, 6 months: Not enough history
Open now: None
Latest incident: 16 Jun 2026
Incidents on record: 3

Response to exploited bugs

Not rated. No reviewed zero-days yet.

Fixing privately reported bugs

Not rated. No private reports in the grading window.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
Fixing privately reported bugs: not rated. No private reports in the last 36 months.
2 of 3 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade.
NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.

Response to exploited bugs: sub-scores

Time to first advisoryNo reviewed zero-days in the last 36 months
NR
0 cases, not used
Time to first fixNo reviewed zero-days in the last 36 months
NR
0 cases, not used
Time to fix all versionsNo reviewed zero-days in the last 36 months
NR
0 cases, not used
OpennessNo machine-readable advisory feed listed
42
2 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

Private fix speedNo private reports in the last 36 months
NR
0 cases, not used

Response fingerprint

Compressed time scale

Counts toward the response grade 0

No incidents count toward the grade yet.

Not graded 3: n-days, unreviewed timelines and end-of-life products

16 Jun 2026
Zyxel GS1900 series switches CGI stack-based buffer overflowNot graded: n-day
28 Jan 2025
Zyxel legacy DSL CPE command injection flaws exploited by Mirai; end-of-life, no fixEnd of life: vendor advises replacementNot graded: end of life
9 Oct 2024
Zyxel ZLD firewall web management directory traversal used by Helldown ransomwareNot graded: n-day

Vendor silent
Vendor statement, no fix
Fixed for some versions
Open, no fix
Open, partly fixed
Fixed when disclosed
Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

First report	Incident	CVSS	Silence	First fix	All fixed	Status	Grade
16 Jun 2026	Zyxel GS1900 series switches CGI stack-based buffer overflowCVE-2026-7273	8.8	same day	same day	same day	Fixed	Not graded: n-day
28 Jan 2025	Zyxel legacy DSL CPE command injection flaws exploited by Mirai; end-of-life, no fixCVE-2024-40890, CVE-2024-40891, CVE-2025-0890	8.8	7d	open	not dated	End of lifeVendor advises replacement	Not graded: end of life
9 Oct 2024	Zyxel ZLD firewall web management directory traversal used by Helldown ransomwareCVE-2024-11667	7.5	0h	same day	same day	Fixed	Not graded: n-day

Private reports

Bugs reported privately to Zyxel by ZDI or Project Zero.

No privately reported cases from ZDI or Project Zero in the window.

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Zyxel's own alerts

XZyxel on XFollow the account and turn on notifications.
Advisory pageZyxel security advisoriesCheck the advisory page. It has no push channel.

What we watch

Advisory pageZyxel security advisories

See sources and health for when each was last read.