CVE-2017-6884: Zyxel EMG2926 Routers Command Injection Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 18 Sep 2023, 2,356 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 33%
EPSS score, percentile 98.4 of all scored records
- How severe?
- 8.8 High
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA deadline 9 Oct 2023. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: 9 October 2023.
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe
- https://www.zyxelguard.com/Zyxel-EOL.asp
- https://nvd.nist.gov/vuln/detail/CVE-2017-6884
Affected products and versions
The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2017-6884 to its Known Exploited Vulnerabilities (KEV) catalog on 18 Sep 2023.
- CISA marks it as known to be used in ransomware campaigns.
- The due date CISA sets for the required action is 9 Oct 2023.
- The CVE record was published on 6 Apr 2017, 2,356 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 8.8 (High), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 33% (percentile 98.4), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 6 Apr 2017 | CVE record published |
| 18 Sep 2023 | Added to CISA KEV |
| 9 Oct 2023 | CISA due date for the required action |
| 1 Oct 2026 | CVE record last updated |
References
More exploited Zyxel vulnerabilities
- CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability
- CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability
- CVE-2024-11667: Zyxel Multiple Firewalls Path Traversal Vulnerability
- CVE-2017-18368: Zyxel P660HN-T1A Routers Command Injection Vulnerability
- CVE-2023-27992: Zyxel Multiple NAS Devices Command Injection Vulnerability