CVE-2021-4030: Zyxel NBG6816 Firmware

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts.

Affected products

• Zyxel NBG6816 Firmware: version 1.00(aawb.10)c0 only
• Zyxel NBG6817 Firmware: before 1.00\(abcs.11\)c0 (fixed in 1.00\(abcs.11\)c0)

Published 2022-02-24. Last modified 2026-06-17.