{"id":"CVE-2017-6884","kind":"vulnerability","aliases":["CVE-2017-6884"],"related":[],"title":"zyxel emg2926 firmware: A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8","description":"Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Zyxel EMG2926 routers have a command injection flaw in the nslookup diagnostic function, reachable through the ping_ip parameter of the expert/maintenance/diagnostic/nslookup URI. An attacker can run arbitrary commands on the router, and CISA reports it is known to be exploited in the wild, including in ransomware campaigns.","severity":"critical","cvss":9.0,"epss":null,"exploited":true,"exploited_at":"2023-09-18T00:00:00+00:00","products":[{"name":"Zyxel EMG2926 Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel emg2926 firmware","fixed":[],"affected":"= v1.00\\(aaqt.4\\)b8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["emg2926","exploited","infrastructure","ransomware","routers","self-hosted","zyxel"],"not_affected_if":["admin-interface-not-exposed","no-emg2926-device"],"how_to_check":"Check whether any EMG2926 device is in use and note its firmware version (unknown from sources which versions are affected).\nCheck whether the web admin interface is reachable from the internet or untrusted networks.","fix":"Apply the vendor mitigation from Zyxel per CISA's instruction, or discontinue use of the device if no mitigation is available (fixed version: unknown from sources).\nRestrict admin interface access to trusted networks only.","status":"open","published_at":"2017-04-06T17:59:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:37+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:04:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation from Zyxel per CISA's instruction, or discontinue use of the device if no mitigation is available (fixed version: unknown from sources).\nRestrict admin interface access to trusted networks only.","reach":"network","impact":"high","summary":"Zyxel EMG2926 routers have a command injection flaw in the nslookup diagnostic function, reachable through the ping_ip parameter of the expert/maintenance/diagnostic/nslookup URI. An attacker can run arbitrary commands on the router, and CISA reports it is known to be exploited in the wild, including in ransomware campaigns.","category":"infrastructure","who_cares":["zyxel","emg2926","routers","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router as root.","analyst_note":"Find the vendor advisory from Zyxel and the affected and fixed firmware versions, and confirm whether authentication is required for the nslookup endpoint.","how_to_check":"Check whether any EMG2926 device is in use and note its firmware version (unknown from sources which versions are affected).\nCheck whether the web admin interface is reachable from the internet or untrusted networks.\nunknown whether a specific config setting or log entry reveals exploitation.","needs_analyst":true,"not_affected_if":["no-emg2926-device","admin-interface-not-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000555,"input_tokens":2885,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2017':22A,25A '-6884':23A,26A 'aaqt.4':19A 'action':133C 'appli':134C 'arbitrari':69B 'attack':66B 'b8':20A 'campaign':89B 'cisa':75B,131C 'command':5A,47B,70B,95C,117C 'contain':93C 'cve':21A,24A 'diagnost':53B,101C 'discontinu':140C 'discov':9A 'emg2926':2A,13A,28A,31A,33B,43B,91C 'execut':115C 'expert/maintenance/diagnostic/nslookup':63B,129C 'exploit':34B,82B,111C 'firmwar':3A,17A 'firmware':32A 'flaw':49B 'function':54B,106C 'home':14A 'host':40B 'includ':86B 'infrastructur':35B 'inject':6A,48B,96C 'instruct':138C 'ip':59B,125C 'known':79B 'locat':98C 'malici':108C,116C 'may':110C 'mitig':135C,146C 'nslookup':52B,105C 'numer':112C 'paramet':60B,126C 'per':136C 'ping':58B,124C 'product':144C 'ransomwar':36B,88B 'reachabl':55B 'report':76B 'requir':132C 'router':15A,37B,44B,73B,92C,120C 'routers':29A 'run':68B 'self':39B 'self-host':38B 'specif':103C 'tool':102C 'unavail':148C 'uri':64B,130C 'use':141C 'user':109C 'v1.00':18A 'vector':113C 'vendor':137C 'vulner':7A,97C 'wild':85B 'zyxel':1A,12A,27A,30A,41B,42B,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-04-06T17:59:00+00:00","kev":{"dateAdded":"2023-09-18","dueDate":"2023-10-09","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-6884","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6884","severity":null,"published_at":"2023-09-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-6884","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6884","severity":null,"published_at":"2017-04-06T17:59:00+00:00","modified_at":"2026-10-01T19:17:13+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}