CVE-2022-26413

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-11 · updated 2026-06-17
Weakness: CWE-78

Description

A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.

Affected products

Zyxel AX7501-B0 firmware: before 5.17\(abpc.1\)c0 — fixed in 5.17\(abpc.1\)c0
Zyxel DX5401-B0 firmware: before 5.17\(abyo.1\)c0 — fixed in 5.17\(abyo.1\)c0
Zyxel Emg3525-T50B Firmware: before 5.50\(abpm.6\)c0 — fixed in 5.50\(abpm.6\)c0
Zyxel Emg5523-T50B Firmware: before 5.50\(abpm.6\)c0 — fixed in 5.50\(abpm.6\)c0
Zyxel Emg5723-T50K Firmware: before 5.50\(abom.7\)c0 — fixed in 5.50\(abom.7\)c0
Zyxel Emg6726-B10A Firmware: before 5.13\(abnp.7\)c0 — fixed in 5.13\(abnp.7\)c0
Zyxel Ep240P Firmware: before 5.40\(abh.0\)c0 — fixed in 5.40\(abh.0\)c0
Zyxel EX3510-B0 firmware: before 5.17\(abup.4\)c1 — fixed in 5.17\(abup.4\)c1
Zyxel Ex5401-B0 Firmware: before 5.17\(abyo.1\)c0 — fixed in 5.17\(abyo.1\)c0
Zyxel Ex5501-B0 Firmware: before 5.17\(abry.2\)c0 — fixed in 5.17\(abry.2\)c0
Zyxel Pm7300-T0 Firmware: before 5.42\(acbc.1\)c0 — fixed in 5.42\(acbc.1\)c0
Zyxel Pmg5317-T20B Firmware: before 5.40\(abki.4\)c0 — fixed in 5.40\(abki.4\)c0
Zyxel Pmg5617-T20B2 Firmware: before 5.41\(acbb.1\)c0 — fixed in 5.41\(acbb.1\)c0
Zyxel Pmg5617Ga Firmware: before 5.40\(abna.2\)c0 — fixed in 5.40\(abna.2\)c0
Zyxel Pmg5622Ga Firmware: before 5.40\(abnb.2\)c0 — fixed in 5.40\(abnb.2\)c0
Zyxel Px7501-B0 Firmware: before 5.17\(abpc.1\)c0 — fixed in 5.17\(abpc.1\)c0
Zyxel Vmg1312-T20B Firmware: before 5.50\(absb.5\)c0 — fixed in 5.50\(absb.5\)c0
Zyxel VMG3312-T20A firmware: 5.30(abfx.5)c0
Zyxel VMG3625-T50B firmware: before 5.50\(abpm.6\)c0 — fixed in 5.50\(abpm.6\)c0
Zyxel Vmg3927-B50A Firmware: before 5.17\(abmt.6\)c0 — fixed in 5.17\(abmt.6\)c0
Zyxel Vmg3927-B50B Firmware: before 5.13\(ably.7\)c0 — fixed in 5.13\(ably.7\)c0
Zyxel Vmg3927-B60A Firmware: before 5.17\(abmt.6\)c0 — fixed in 5.17\(abmt.6\)c0
Zyxel Vmg3927-T50K Firmware: before 5.50\(abom.7\)c0 — fixed in 5.50\(abom.7\)c0
Zyxel Vmg4927-B50A Firmware: before 5.13\(ably.7\)c0 — fixed in 5.13\(ably.7\)c0
Zyxel Vmg8623-T50B Firmware: before 5.50\(abpm.6\)c0 — fixed in 5.50\(abpm.6\)c0
Zyxel Vmg8825-B50A Firmware: before 5.17\(abmt.6\)c0 — fixed in 5.17\(abmt.6\)c0
Zyxel Vmg8825-B50B Firmware: before 5.17\(abny.7\)c0 — fixed in 5.17\(abny.7\)c0
Zyxel Vmg8825-B60A Firmware: before 5.17\(abmt.6\)c0 — fixed in 5.17\(abmt.6\)c0
Zyxel Vmg8825-B60B Firmware: before 5.17\(abny.7\)c0 — fixed in 5.17\(abny.7\)c0
Zyxel VMG8825-T50K firmware: before 5.50\(abom.7\)c0 — fixed in 5.50\(abom.7\)c0

How to fix

Upgrade to a fixed version: Zyxel AX7501-B0 firmware 5.17\(abpc.1\)c0; Zyxel DX5401-B0 firmware 5.17\(abyo.1\)c0; Zyxel Emg3525-T50B Firmware 5.50\(abpm.6\)c0; Zyxel Emg5523-T50B Firmware 5.50\(abpm.6\)c0; Zyxel Emg5723-T50K Firmware 5.50\(abom.7\)c0; Zyxel Emg6726-B10A Firmware 5.13\(abnp.7\)c0; Zyxel Ep240P Firmware 5.40\(abh.0\)c0; Zyxel EX3510-B0 firmware 5.17\(abup.4\)c1; Zyxel Ex5401-B0 Firmware 5.17\(abyo.1\)c0; Zyxel Ex5501-B0 Firmware 5.17\(abry.2\)c0; Zyxel Pm7300-T0 Firmware 5.42\(acbc.1\)c0; Zyxel Pmg5317-T20B Firmware 5.40\(abki.4\)c0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-26413 or the next vulnerability affects your stack