Multiple Zyxel devices are prone to critical vulnerabilities resulting from insecure coding practices and insecure configuration. One of the worst vulnerabilities is an unauthenticated buffer overflow in the custom „zhttpd“ webserver. By bypassing ASLR, the buffer overflow can be turned into an unauthenticated remote code execution (RCE). Besides that, multiple other vulnerabilities including unauthenticated file disclosure, authenticated command injection and processing of symbolic links on storage media were found in the firmware. This talk will detail the steps we took to analyze the embedded device and how we reverse engineered the webserver. Furthermore, we will showcase our Metasploit module that is able to gain a root shell on 50+ devices without authentication.