What is the CVSS score of EUVD-2026-31779?

EUVD-2026-31779 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Zyxel GS1200 EUVD-2026-31779

| CVE-2026-4795 MEDIUM

Missing Authorization (CWE-862)

2026-05-26 Zyxel

GHSA-2r2c-hg87-r54j

Authentication Bypass Zyxel Gs1200 5V3 Firmware Gs1200 8V3 Firmware Gs1200 5Hpv3 Firmware Gs1200 8Hpv3 Firmware Gs1200 10V3 Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:35 vuln.today

DescriptionCVE.org

A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.00(ACPT.2)C0, GS1200-5HPv3 firmware versions through 1.00(ACPU.2)C0, GS1200-8HPv3 firmware versions through 1.00(ACPV.2)C0, and GS1200-10v3 firmware versions through 1.00(ACPW.2)C0 could allow a LAN-based, unauthenticated attacker to read the system configuration from a log file via a crafted HTTP request.

AnalysisAI

Missing authorization in Zyxel GS1200v3-series managed switches allows a LAN-based, unauthenticated attacker to read system configuration data from a log file by sending a crafted HTTP request to the device's web interface. All five GS1200v3 models are affected across their current firmware versions. No public exploit has been identified at time of analysis, and both EPSS (0.03%, 11th percentile) and SSVC exploitation status ('none') confirm no observed in-the-wild exploitation, placing this in the category of a real but low-urgency information disclosure risk confined to the local network segment.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to enforce access control checks before serving a protected resource. Here, the GS1200v3 firmware's HTTP server exposes a log file endpoint that contains system configuration without verifying the requester's identity or privilege level. The affected devices are Layer 2 managed Gigabit Ethernet switches - the GS1200-5v3, GS1200-8v3, GS1200-5HPv3, GS1200-8HPv3, and GS1200-10v3 - identified by CPE strings cpe:2.3:a:zyxel:gs1200-[5/8/5hp/8hp/10]v3_firmware. The CVSS attack vector AV:A (Adjacent) reflects that the HTTP interface targeted is accessible only to hosts on the same Layer 2 or directly connected network segment, not the broader internet. The CWE root cause is architectural: a web handler that serves sensitive data without a gating authorization check, rather than a memory corruption or injection flaw.

RemediationAI

Patch available per vendor advisory - consult the Zyxel security advisory at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-missing-authorization-vulnerability-in-gs1200v3-series-switches-05-26-2026 for the exact patched firmware version for each model, as no specific fix version number was included in the available intelligence data. Until firmware can be updated, restrict access to the switch management interface by placing it on a dedicated out-of-band management VLAN accessible only to authorized administrative hosts - this directly addresses the AV:A attack vector by limiting who shares a network segment with the device. If VLAN isolation is not feasible, apply ACLs on upstream devices to limit HTTP access to the switch's management IP to known admin workstations only. Note that neither workaround eliminates the missing authorization flaw; they reduce the attacker population. Do not expose management interfaces on shared or guest LAN segments.