CVE-2026-1459 — OS Command Injection in Zyxel Vmg3625-t50b Firmware

CWE-78 — OS Command Injection3 documents3 sources
Severity
7.2HIGHNVD
EPSS
0.0%
top 92.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Zyxel Vmg3625-t50b FirmwareZyxel Dx5401-b1 FirmwareZyxel Emg3525-t50b Firmware+3 more
Timeline
PublishedFeb 24

Description

A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5zyxel/vmg3625-t50b_firmware5.50(ABPM.9.7)C0
▶NVDzyxel/vmg3625-t50b_firmware5.50\(abpm.9.7\)c0
▶NVDzyxel/emg3525-t50b_firmware5.50\(abpm.9.7\)c0
▶NVDzyxel/emg5523-t50b_firmware5.50\(abpm.9.7\)c0
▶NVDzyxel/vmg3625-t50c_firmware5.50\(abpm.9.7\)c0

🔴Vulnerability Details

2
CVEList
CVE-2026-1459: A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions throu↗2026-02-24
▶
GHSA
GHSA-x6c4-87pg-m84f: A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions throu↗2026-02-24
▶
CVE-2026-1459 — OS Command Injection in Zyxel | cvebase