A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8.

published 2017-04-06 9 y ago modified 2026-10-01 38 d ago also EUVD-2017-15938

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2023-09-18, used in ransomware
epss: 33.0%; EPSS 33.0% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Exploit-DB

A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Timeline

2017-04-02 First public exploit (EDB-41782)
2017-04-06 Published
2023-09-18 Added to CISA KEV
2023-10-09 CISA patch deadline
2026-08-04 CISA SSVC: exploitation active

Known exploited

Added: 3 y ago (2023-09-18)
Patch by: 2023-10-09 (3 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product: Zyxel, EMG2926 Routers
CISA name: Zyxel EMG2926 Routers Command Injection Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-08-04)

Exploit prediction

32.98% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-41782 Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection webapps, 2017-04-02

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/41782/
exploit, third-party-advisory, vdb-entry
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884
government-resource, us-government-resource

Sources

CVE List CVE-2017-6884
NVD CVE-2017-6884

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary