---
id: "CVE-2017-6884"
kind: "vulnerability"
aliases: ["CVE-2017-6884"]
title: "zyxel emg2926 firmware: A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8"
severity: "critical"
cvss: 9.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Zyxel EMG2926 Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "zyxel emg2926 firmware", "fixed": [], "affected": "= v1.00\\(aaqt.4\\)b8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["emg2926", "exploited", "infrastructure", "ransomware", "routers", "self-hosted", "zyxel"]
not_affected_if: ["admin-interface-not-exposed", "no-emg2926-device"]
published_at: "2017-04-06T17:59:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6884", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6884", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# zyxel emg2926 firmware: A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8

Zyxel EMG2926 routers have a command injection flaw in the nslookup diagnostic function, reachable through the ping_ip parameter of the expert/maintenance/diagnostic/nslookup URI. An attacker can run arbitrary commands on the router, and CISA reports it is known to be exploited in the wild, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zyxel EMG2926 Routers affected ? fixed ?
- vendor:zyxel emg2926 firmware affected = v1.00\(aaqt.4\)b8 fixed ?

## How to check

Check whether any EMG2926 device is in use and note its firmware version (unknown from sources which versions are affected).
Check whether the web admin interface is reachable from the internet or untrusted networks.

## Fix

Apply the vendor mitigation from Zyxel per CISA's instruction, or discontinue use of the device if no mitigation is available (fixed version: unknown from sources).
Restrict admin interface access to trusted networks only.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6884
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-6884

## From the sources

Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_