Improper authentication in Zyxel NBG6818 series firmware
Priority LOW 34CWE-260Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.
Why it matters now
EPSS 0.00409 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zyxel | NBG6818 series firmware | 1.00(ABSC.0)C0 through 1.00(ABSC.4)C0 | — | No fix listed | CNA |
| Zyxel | NBG7815 series firmware | 1.00(ABSK.0)C0 through 1.00(ABSK.6)C0 | — | No fix listed | CNA |
| Zyxel | WSQ20 series firmware | 1.00(ABOF.0)C0 through 1.00(ABOF.10)C0 | — | No fix listed | CNA |
| Zyxel | WSQ50 series firmware | 1.00(ABKJ.0)C0 through 2.20(ABKJ.6)C0 | — | No fix listed | CNA |
| Zyxel | WSQ60 series firmware | 1.00(ABND.0)C0 through 2.20(ABND.7)C0 | — | No fix listed | CNA |
| Zyxel | WSR30 series firmware | 1.00(ABMY.0)C0 through 1.00(ABMY.11)C0 | — | No fix listed | CNA |
- NBG6818 series firmware VendorZyxel Affected 1.00(ABSC.0)C0 through 1.00(ABSC.4)C0 Fixed in — No fix listed CNA
- NBG7815 series firmware VendorZyxel Affected 1.00(ABSK.0)C0 through 1.00(ABSK.6)C0 Fixed in — No fix listed CNA
- WSQ20 series firmware VendorZyxel Affected 1.00(ABOF.0)C0 through 1.00(ABOF.10)C0 Fixed in — No fix listed CNA
- WSQ50 series firmware VendorZyxel Affected 1.00(ABKJ.0)C0 through 2.20(ABKJ.6)C0 Fixed in — No fix listed CNA
- WSQ60 series firmware VendorZyxel Affected 1.00(ABND.0)C0 through 2.20(ABND.7)C0 Fixed in — No fix listed CNA
- WSR30 series firmware VendorZyxel Affected 1.00(ABMY.0)C0 through 1.00(ABMY.11)C0 Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zyxel:nbg6818_firmware:*:*:*:*:*:*:*:* | before 1.00\(absc.5\)c0 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nbg6818:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nbg7815_firmware:*:*:*:*:*:*:*:* | before 1.00\(absk.7\)c0 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nbg7815:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wsq20_firmware:*:*:*:*:*:*:*:* | before 1.00\(abof.11\)c0 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wsq20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wsq50_firmware:*:*:*:*:*:*:*:* | before 2.20\(abkj.7\)c0 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wsq50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wsq60_firmware:*:*:*:*:*:*:*:* | before 2.20\(abnd.8\)c0 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wsq60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
- cpe:2.3:o:zyxel:nbg6818_firmware:*:*:*:*:*:*:*:* Versions before 1.00\(absc.5\)c0 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nbg6818:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nbg7815_firmware:*:*:*:*:*:*:*:* Versions before 1.00\(absk.7\)c0 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nbg7815:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wsq20_firmware:*:*:*:*:*:*:*:* Versions before 1.00\(abof.11\)c0 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wsq20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wsq50_firmware:*:*:*:*:*:*:*:* Versions before 2.20\(abkj.7\)c0 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wsq50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wsq60_firmware:*:*:*:*:*:*:*:* Versions before 2.20\(abnd.8\)c0 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wsq60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35033
- 2026-10-03 Alias added: GHSA-pm46-rmc8-j8j3
References
Sources
- CVE-2021-35033 · CVE Program
- CVE-2021-35033 · NVD
- FIRST EPSS
- GHSA-pm46-rmc8-j8j3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences