High severity · published Apr 6, 2017
CVE-2017-6884
Zyxel EMG2926 Routers Command Injection Vulnerability
RansomwareIn wildKEV
8.8
CVSS
33%
EPSS
Yes
On KEV
Description
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)33.0% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 18, 2023
Federal remediation dueOct 9, 2023
Ransomware campaign useKnown
Affected products
Which versions
EF
Emg2926 Firmware · Zyxel
v1.00(aaqt.4)b8 · source: NVD
ER
EMG2926 Routers · Zyxel
All versions, or not specified · source: KEV