Skip to main content

Dx5401 B1 Firmware CVE-2026-1459

HIGH
OS Command Injection (CWE-78)
2026-02-24 security@zyxel.com.tw
Command Injection Zyxel Dx5401 B1 Firmware Emg3525 T50b Firmware Emg5523 T50b Firmware Vmg3625 T50b Firmware Vmg3625 T50c Firmware Vmg8623 T50b Firmware
7.2
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate as administrator
  2. Exploit
    Access TR-369 certificate download CGI
  3. Execution
    Inject OS commands in certificate parameter
  4. Impact
    Execute arbitrary commands on device

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Administrator-level authentication required on Zyxel VMG3625-T50B running firmware version 5.50(ABPM.9.7)C0 or earlier; TR-369 certificate download CGI must be accessible; attacker must have valid administrative credentials.
Impact

CVSS 7.2 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: None. Exploitation requires authentication.
Exploit ScenarioDerived

An attacker (requires authentication) could exploit this vulnerability to an authenticated attacker with administrator privileges to execute operating sys.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Zyxel VMG3625-T50B, DX5401 B1, and EMG5523 T50B devices with firmware through version 5.50(ABPM.9.7)C0 contain a post-authentication command injection vulnerability in the TR-369 certificate download function that allows authenticated administrators to execute arbitrary operating system commands. An attacker with admin credentials could leverage this to gain complete control over the affected device. No patch is currently available.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 7.2

A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device. [CVSS 7.2 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-78 (OS Command Injection). Affects Vmg8623-T50B Firmware. A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

Know when Dx5401 B1 Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

Executive ViewAI

Why It Matters

A vulnerability in Zyxel VMG3625-T50B devices allows authenticated administrators to execute unauthorized commands, potentially compromising network infrastructure and sensitive data. Organizations using this gateway model face elevated risk until mitigation steps are implemented, as no patch is currently available.

Business Impact: High
Compensating Controls

Restrict administrative access to the device via ACLs and network segmentation; disable the TR-369 certificate download CGI feature if not mission-critical; implement network-based monitoring for suspicious command patterns; consider replacing the device with a supported alternative model from the vendor; maintain detailed audit logs of all administrator activities on the device.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Affected Products (CPE)CVE.org

cpe:2.3:o:zyxel:vmg8623-t50b_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:dx5401-b1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:emg3525-t50b_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:emg5523-t50b_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg3625-t50b_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg3625-t50c_firmware:*:*:*:*:*:*:*:*

More in Dx5401 B1 Firmware

View all
CVE-2025-8693 HIGH
8.8 Nov 18

A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(A
CVE-2025-13943 HIGH
8.8 Feb 24

A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware

CVE-2025-6599 HIGH
7.5 Nov 18

Slowloris-style denial of service in Zyxel DX3301-T0 firmware 5.50(ABVY.6.3)C0 and earlier, with the vendor advisory cov
CVE-2024-8748 HIGH
7.5 Dec 03

A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmwa
CVE-2024-5412 HIGH
7.5 Sep 03

A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 cou
CVE-2024-0816 MEDIUM
5.5 May 21

The buffer overflow vulnerability in the DX3300-T1 firmware version V5.50(ABVY.4)C0 could allow an authenticated local a
CVE-2025-11845 MEDIUM
4.9 Feb 24

A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware ve
CVE-2025-11848 MEDIUM
4.9 Feb 24

A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version throu
CVE-2025-11847 MEDIUM
4.9 Feb 24

A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions thro
CVE-2025-11846 MEDIUM
4.9 Feb 24

A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions
CVE-2024-9197 MEDIUM
4.9 Dec 03

A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B f
CVE-2024-38269 MEDIUM
4.9 Sep 24

An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy