TI-2022-09766 Aliases CVE-2022-26414 GHSA-wvj8-qqh4-8vmv

Buffer overflow in Zyxel VMG3312-T20A firmware

LOW 26CWE-120Published 2022-04-11 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, which could be exploited by a local authenticated attacker to cause a denial of service.

Why it matters now

EPSS 0.00208 11th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zyxel	VMG3312-T20A firmware	V5.30(ABFX.5)C0	—	No fix listed	CNA

VMG3312-T20A firmware VendorZyxel Affected V5.30(ABFX.5)C0 Fixed in — No fix listed CNA

CPE configurations NVD · 66

CPE	Versions	Role	Vendor
cpe:2.3:o:zyxel:vmg3312-t20a_firmware:5.30\(abfx.5\)c0:::::::*	5.30(abfx.5)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3312-t20a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:emg3525-t50b_firmware:::::america:::*	before 5.50\(abpm.6\)c0	Vulnerable	Zyxel
cpe:2.3:o:zyxel:emg3525-t50b_firmware:::::emea:::*	before 5.50\(abpm.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:emg3525-t50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:emg5523-t50b_firmware:::::america:::*	before 5.50\(abpm.6\)c0	Vulnerable	Zyxel
cpe:2.3:o:zyxel:emg5523-t50b_firmware:::::emea:::*	before 5.50\(abpm.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:emg5523-t50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:emg5723-t50k_firmware::::::::	before 5.50\(abom.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:emg5723-t50k:-:::::::*	not specified by NVD	Running on	Zyxel

cpe:2.3:o:zyxel:vmg3312-t20a_firmware:5.30\(abfx.5\)c0:*:*:*:*:*:*:* Versions 5.30(abfx.5)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3312-t20a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:emg3525-t50b_firmware:*:*:*:*:america:*:*:* Versions before 5.50\(abpm.6\)c0 Vulnerable ·Zyxel
cpe:2.3:o:zyxel:emg3525-t50b_firmware:*:*:*:*:emea:*:*:* Versions before 5.50\(abpm.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:emg3525-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:emg5523-t50b_firmware:*:*:*:*:america:*:*:* Versions before 5.50\(abpm.6\)c0 Vulnerable ·Zyxel
cpe:2.3:o:zyxel:emg5523-t50b_firmware:*:*:*:*:emea:*:*:* Versions before 5.50\(abpm.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:emg5523-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:emg5723-t50k_firmware:*:*:*:*:*:*:*:* Versions before 5.50\(abom.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:emg5723-t50k:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Show 56 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:zyxel:emg6726-b10a_firmware::::::::	before 5.13\(abnp.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:emg6726-b10a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg1312-t20b_firmware::::::::	before 5.50\(absb.5\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg1312-t20b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg3625-t50b_firmware::::::::	before 5.50\(abpm.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3625-t50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg3927-b50a_firmware::::::::	before 5.17\(abmt.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3927-b50a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg3927-b50b_firmware::::::::	before 5.13\(ably.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3927-b50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg3927-b60a_firmware::::::::	before 5.17\(abmt.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3927-b60a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg3927-t50k_firmware::::::::	before 5.50\(abom.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3927-t50k:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg4927-b50a_firmware::::::::	before 5.13\(ably.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg4927-b50a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg8623-t50b_firmware::::::::	before 5.50\(abpm.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg8623-t50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg8825-b50a_firmware::::::::	before 5.17\(abmt.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg8825-b50a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg8825-b50b_firmware::::::::	before 5.17\(abny.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg8825-b50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg8825-t50k_firmware::::::::	before 5.50\(abom.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg8825-t50k:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg8825-b60a_firmware::::::::	before 5.17\(abmt.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg8825-b60a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg8825-b60b_firmware::::::::	before 5.17\(abny.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg8825-b60b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:xmg3927-b50a_firmware::::::::	before 5.17\(abmt.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:xmg3927-b50a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:xmg8825-b50a_firmware::::::::	before 5.17\(abmt.6\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:xmg8825-b50a:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:dx5401-b0_firmware::::::::	before 5.17\(abyo.1\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:dx5401-b0:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:ex3510-b0_firmware::::::::	before 5.17\(abup.4\)c1	Vulnerable	Zyxel
cpe:2.3:h:zyxel:ex3510-b0:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:ex5401-b0_firmware::::::::	before 5.17\(abyo.1\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:ex5401-b0:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:ex5501-b0_firmware::::::::	before 5.17\(abry.2\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:ex5501-b0:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:ax7501-b0_firmware::::::::	before 5.17\(abpc.1\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:ax7501-b0:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:ep240p_firmware::::::::	before 5.40\(abh.0\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:ep240p:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:pm7300-t0_firmware::::::::	before 5.42\(acbc.1\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:pm7300-t0:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:pmg5317-t20b_firmware::::::::	before 5.40\(abki.4\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:pmg5317-t20b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:pmg5617ga_firmware::::::::	before 5.40\(abna.2\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:pmg5617ga:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:pmg5617-t20b2_firmware::::::::	before 5.41\(acbb.1\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:pmg5617-t20b2:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:pmg5622ga_firmware::::::::	before 5.40\(abnb.2\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:pmg5622ga:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:px7501-b0_firmware::::::::	before 5.17\(abpc.1\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:px7501-b0:-:::::::*	not specified by NVD	Running on	Zyxel

cpe:2.3:o:zyxel:emg6726-b10a_firmware:*:*:*:*:*:*:*:* Versions before 5.13\(abnp.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:emg6726-b10a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg1312-t20b_firmware:*:*:*:*:*:*:*:* Versions before 5.50\(absb.5\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg1312-t20b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg3625-t50b_firmware:*:*:*:*:*:*:*:* Versions before 5.50\(abpm.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3625-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg3927-b50a_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abmt.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3927-b50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg3927-b50b_firmware:*:*:*:*:*:*:*:* Versions before 5.13\(ably.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3927-b50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg3927-b60a_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abmt.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3927-b60a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg3927-t50k_firmware:*:*:*:*:*:*:*:* Versions before 5.50\(abom.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3927-t50k:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg4927-b50a_firmware:*:*:*:*:*:*:*:* Versions before 5.13\(ably.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg4927-b50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg8623-t50b_firmware:*:*:*:*:*:*:*:* Versions before 5.50\(abpm.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg8623-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg8825-b50a_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abmt.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg8825-b50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg8825-b50b_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abny.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg8825-b50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg8825-t50k_firmware:*:*:*:*:*:*:*:* Versions before 5.50\(abom.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg8825-t50k:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg8825-b60a_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abmt.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg8825-b60a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg8825-b60b_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abny.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg8825-b60b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:xmg3927-b50a_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abmt.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:xmg3927-b50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:xmg8825-b50a_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abmt.6\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:xmg8825-b50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:dx5401-b0_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abyo.1\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:dx5401-b0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:ex3510-b0_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abup.4\)c1 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:ex3510-b0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:ex5401-b0_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abyo.1\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:ex5401-b0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:ex5501-b0_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abry.2\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:ex5501-b0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:ax7501-b0_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abpc.1\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:ax7501-b0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:ep240p_firmware:*:*:*:*:*:*:*:* Versions before 5.40\(abh.0\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:ep240p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:pm7300-t0_firmware:*:*:*:*:*:*:*:* Versions before 5.42\(acbc.1\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:pm7300-t0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:pmg5317-t20b_firmware:*:*:*:*:*:*:*:* Versions before 5.40\(abki.4\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:pmg5317-t20b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:pmg5617ga_firmware:*:*:*:*:*:*:*:* Versions before 5.40\(abna.2\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:pmg5617ga:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:pmg5617-t20b2_firmware:*:*:*:*:*:*:*:* Versions before 5.41\(acbb.1\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:pmg5617-t20b2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:pmg5622ga_firmware:*:*:*:*:*:*:*:* Versions before 5.40\(abnb.2\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:pmg5622ga:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:px7501-b0_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abpc.1\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:px7501-b0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-26414
2026-10-03 Alias added: GHSA-wvj8-qqh4-8vmv

References

Advisory 1

https://www.zyxel.com/support/OS-command-injection-and-buffer-overflow-vulnerabilities-of-CPE-and-ONTs.shtml

TI-2025-07956 OS command injection in Zyxel DX3300-T0 firmware CVSS 3.1HIGH 8.8
TI-2022-21188 OS command injection in Zyxel NR7101 firmware CVSS 3.1HIGH 8.8
TI-2024-05028 Buffer overflow in Zyxel VMG8825-T50K firmware CVSS 3.1HIGH 7.5
TI-2025-05994 Uncontrolled resource consumption in Zyxel DX3301-T0 firmware CVSS 3.1HIGH 7.5
TI-2024-08115 Buffer overflow in Zyxel VMG8825-T50K firmware CVSS 3.1HIGH 7.5
TI-2024-11143 OS command injection in Zyxel AX7501-B1 firmware CVSS 3.1HIGH 7.2

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences