Command Injection in Zyxel EMG2926 Routers (CVE‑2017‑6884) Enables Remote Code Execution
What It Is – The Zyxel EMG2926 router’s diagnostic interface contains a command‑injection flaw in the nslookup utility. An attacker can supply a crafted ping_ip parameter to the /expert/maintenance/diagnostic/nslookup endpoint and force the router to execute arbitrary OS commands.
Exploitability – The vulnerability is publicly disclosed; proof‑of‑concept code exists. No widespread active exploit reports, but the CVSS v3.1 base score is 7.5 (High), indicating a realistic risk for remote attackers with network access.
Affected Products – Zyxel EMG2926 residential/SMB gateway routers (all firmware versions prior to the vendor’s security patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous asset discovery and firmware‑version tracking as evidence of due‑diligence.
- Highlights the importance of logging diagnostic‑module activity and correlating it with a control‑monitoring platform to prove a defensible audit trail.
- A timely patch‑management process is a core control that satisfies multiple framework objectives (e.g., NIST CSF “Protect” and ISO 27001 “Asset Management”).
Recommended Actions
- Verify firmware version on all EMG2926 devices and apply Zyxel’s security update (or upgrade to a newer model).
- Block external access to the
/expert/maintenance/diagnostic/*URI via firewall or ACLs. - Enable and centralize syslog for router diagnostics; alert on unexpected
nslookupcommands. - Record remediation steps in your control‑evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2017‑6884