A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password manage…

published 2021-11-23 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-21680

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits: 0; none known

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.

Patch / fix

fixed in 6

zyxel nbg6818_firmware 1.00\(absc.5\)c0
zyxel nbg7815_firmware 1.00\(absk.7\)c0
zyxel wsq20_firmware 1.00\(abof.11\)c0
zyxel wsq50_firmware 2.20\(abkj.7\)c0
zyxel wsq60_firmware 2.20\(abnd.8\)c0
zyxel wsr30_firmware 1.00\(abmy.12\)c0

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

tenable.com https://www.tenable.com/security/research/tra-2022-06 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

Zyxel NBG6818 series firmware
Zyxel NBG7815 series firmware
Zyxel WSQ20 series firmware
Zyxel WSQ50 series firmware
Zyxel WSQ60 series firmware
Zyxel WSR30 series firmware

Classification

Weakness

CWE-260 Password in Configuration File
CWE-287 Improper Authentication

References

tenable.com /security/research/tra-2022-06
exploit, third-party-advisory
zyxel.com /support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi
vendor-advisory

Sources

CVE List CVE-2021-35033
NVD CVE-2021-35033

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary