Zyxel EMG2926 Routers Command Injection Vulnerability (CVE-2017-6884)
Published Last modified In CISA KEV since Sources: CVE.org
What is affected, what to do
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function.
The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Zyxel Emg2926 Firmware
eq v1.00\(aaqt.4\)b8..v1.00\(aaqt.4\)b8
- Zyxel Emg2926 Firmware
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
8.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
8.8
CVSS v3
Severity High on the scale from 0 to 10.
Source: CVE.org
33.0 %
EPSS score
Elevated — model estimates 10-50% exploitation likelihood.
Source: FIRST EPSS, percentile 98.4
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 246.40 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploited
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 8.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 8.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 33.0 %
- Elevated — model estimates 10-50% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 98.4
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- CISA assessment (SSVC)
- Exploitation: active · not automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 4 August 2026
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-78
Response and mitigation
Why act now?
Prioritisation rationale
The flaw is network-reachable with low complexity and needs only a low-privileged account, and default or weak credentials are common on consumer routers. Successful exploitation gives full control of the device. Exploitation likelihood is very high, and CISA flags the vulnerability as used in ransomware campaigns. Typical targets are small sites, home-office links and forgotten edge devices, which attackers repurpose as botnet nodes, proxies or initial-access footholds. Wherever an EMG2926 terminates corporate traffic, treat it as top priority and isolate or replace it within 24 h. Purely residential links separated from the corporate network warrant elevated, but not emergency, priority.
Runbook step 1
Immediate response (0-24 h)
- Inventory: Identify every Zyxel EMG2926 in the estate, including shadow IT at branch sites, admin home-office lines and OT remote-maintenance links. Check the firmware version in the web GUI or with an asset scan. V1.00(AAQT.4)b8 is confirmed vulnerable.
- Check for a patch: A patch may be available from the vendor. Look up the fixed version in the vendor advisory. The EMG2926 is a consumer device, so verify its support status with Zyxel. If no fixed firmware is offered, classify the device as unmaintainable and schedule its replacement.
- Lock down the management interface: Disable WAN-side access to the web management interface (typically TCP 80/443) immediately. Internally, allow access only from a dedicated admin segment.
- Rotate credentials: A low-privileged account is enough to exploit the flaw. Reset every router account with a unique, strong password and remove default or shared credentials.
- Handle suspected compromise: If compromise is suspected, disconnect the device. Capture the config, DNS settings, port forwards and running processes where accessible. Then factory-reset it, flash current firmware and rebuild the configuration by hand rather than restoring a backup.
- Replace at critical sites: If no clean firmware exists, replace the device with a supported business-grade gateway within 24 h at critical-infrastructure or business-critical sites.
Runbook step 2
Mitigation layers
- Network segmentation: Treat the router as an untrusted perimeter device. Put a dedicated firewall or VLAN boundary behind it so a compromise cannot pivot straight into server or OT segments.
- Management access control: Use an ACL so the web GUI is reachable only from a single jump-host IP. Disable all remote management entirely: WAN-side HTTP/HTTPS, Telnet and SSH.
- IPS/WAF rule: Where an upstream IPS or reverse proxy exists, block HTTP requests to
expert/maintenance/diagnostic/nslookupwhen theping_ipparameter contains shell metacharacters (;,|,`,$(,&&). Suricata example:alert http any any -> $HOME_NET any (msg:"CVE-2017-6884 Zyxel nslookup cmd injection"; http.uri; content:"/diagnostic/nslookup"; nocase; pcre:"/ping_ip=[^&]*(%3B|;|%7C|\||%60||%24%28|$()/Ui"; sid:9000001; rev:1;)` - Egress filtering: Restrict outbound traffic from the router's management interface to DNS and NTP towards defined servers. Prevent the router from fetching HTTP or TFTP content from the internet, which is the usual path for downloading botnet payloads.
- IAM / least privilege: Remove guest and user accounts that can reach the web GUI. Keep one named admin account per responsible person.
Runbook step 3
Detection rules
- Zeek http.log / proxy logs: Hunt for the URI path carrying injected commands. KQL example:
CommonSecurityLog | where RequestURL has "diagnostic/nslookup" and RequestURL matches regex @"ping_ip=[^&]*(%3B|;|%7C|\||%60|\$\()" - Router syslog: Forward syslog to the SIEM. Alert on logins followed by diagnostic-tool calls, on unexpected config changes (DNS servers, port forwards, remote access enabled) and on reboots outside maintenance windows.
- Network telemetry (Zeek conn.log / NetFlow): Flag outbound connections from the router IP to unknown hosts, such as TCP 23/2323, high ports, or HTTP/TFTP downloads. SPL example:
index=zeek sourcetype=conn id.orig_h=<router_ip> NOT dest_port IN (53,123) | stats count by id.resp_h, id.resp_p - Scanning behaviour: A sudden burst of connection attempts originating from the router is a strong botnet-infection signal. Typical patterns are Telnet and SSH sweeps against external ranges.
- DNS anomalies: Watch for clients behind the router suddenly resolving through foreign resolvers. This indicates tampered DHCP or DNS settings.
- Zeek http.log / proxy logs: Hunt for the URI path carrying injected commands. KQL example:
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
Source: cvelistv5, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)
Vendors and products
Affected operating systems
| Other | zyxel | emg2926_firmware | v1.00\(aaqt.4\)b8 |
Weakness classes (CWE)
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Base
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Entry at MITRE CWE-78
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited | |
| Exploit-DB | EDB-ID 41782 (opens in a new tab)exploit-db.com | PoC (publicly reported)reported, not verified | — |
References & sources
- exploit-db.com41782Exploit, x_refsource_EXPLOIT-DB
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884government-resource
Changes to this CVE
Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).
Record modifiedMITRE
New references:Show 3 original changes
Individual changes of this event as published by NVD Type Action Before After Reference added —https://www.exploit-db.com/exploits/41782/Reference removed https://www.exploit-db.com/exploits/41782/—Reference type removed https://www.exploit-db.com/exploits/41782/ Types: Exploit, Third Party Advisory, VDB Entry—Source identifier: cve@mitre.org
Record modifiedCISA ADP
CISA assessment (SSVC): exploitation: active, automatable: no
Show 5 original changes
Individual changes of this event as published by NVD Type Action Before After Reference added —https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884Reference removed https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884—Reference type removed https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884 Types: US Government Resource—SSVC assessment removed {"id":"CVE-2017-6884","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2023-09-15T00:00:00+00:00"}—SSVC assessment added —{"id":"CVE-2017-6884","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-04T03:55:51.006237Z"}Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Record modifiedCVE Program
New references:Show 3 original changes
Individual changes of this event as published by NVD Type Action Before After Reference added —https://www.exploit-db.com/exploits/41782/Reference removed https://www.exploit-db.com/exploits/41782/—Reference type removed https://www.exploit-db.com/exploits/41782/ Types: Exploit, Third Party Advisory, VDB Entry—Source identifier: af854a3a-2127-422b-91ae-364da2661108
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2017-6884"><img src="https://intel.neosec.eu/badge/cve/CVE-2017-6884.svg?lang=en" alt="CVE-2017-6884 – NEOSEC Intel" height="20"></a>