CVE-2021-35034: Zyxel NBG6604 Firmware

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.

Affected products

• Zyxel NBG6604 Firmware: before 1.00\(abir.9\)c0 (fixed in 1.00\(abir.9\)c0)

Published 2021-12-29. Last modified 2026-06-17.