CVE-2026-1459

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-24 · updated 2026-06-17
Weakness: CWE-78

Description

A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

Affected products

Zyxel Dx5401-B1 Firmware: through 5.17\(abyo.7.1\)c0
Zyxel Emg3525-T50B Firmware: through 5.50\(abpm.9.7\)c0
Zyxel Emg5523-T50B Firmware: through 5.50\(abpm.9.7\)c0
Zyxel VMG3625-T50B firmware: through 5.50\(abpm.9.7\)c0
Zyxel Vmg3625-T50C Firmware: through 5.50\(abpm.9.7\)c0
Zyxel Vmg8623-T50B Firmware: through 5.50\(abpm.9.7\)c0

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

Get alerted when CVE-2026-1459 or the next vulnerability affects your stack