Zyxel Multiple Firewalls known exploited vulnerabilities, ranked
CISA lists 5 Zyxel Multiple Firewalls CVEs as exploited in the wild. 0 were added in the last 12 months and 1 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2022-30525: EPSS 99.94%, added 2022-05-16
- CVE-2023-28771: EPSS 99.28%, added 2023-05-31
- CVE-2023-33010: EPSS 28.8%, added 2023-06-05
- CVE-2023-33009: EPSS 28.1%, added 2023-06-05
- CVE-2024-11667: EPSS 2.9%, used in ransomware, added 2024-12-03
All 5 Zyxel Multiple Firewalls CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2022-30525 | Multiple Firewalls OS Command Injection | 99.94% | – | 2022-05-16 | 2022-06-06 |
| 2 | CVE-2023-28771 | Multiple Firewalls OS Command Injection | 99.28% | – | 2023-05-31 | 2023-06-21 |
| 3 | CVE-2023-33010 | Multiple Firewalls Buffer Overflow | 28.8% | – | 2023-06-05 | 2023-06-26 |
| 4 | CVE-2023-33009 | Multiple Firewalls Buffer Overflow | 28.1% | – | 2023-06-05 | 2023-06-26 |
| 5 | CVE-2024-11667 | Multiple Firewalls Path Traversal | 2.9% | Yes | 2024-12-03 | 2024-12-24 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Zyxel KEV CVEs · free KEV badge for Zyxel · all vendors