TI-2026-01156 Aliases CVE-2026-1459 GHSA-x6c4-87pg-m84f

OS command injection in Zyxel VMG3625-T50B firmware

LOW 35CWE-78Published 2026-02-24 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00955 61st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zyxel	VMG3625-T50B firmware	up to 5.50(ABPM.9.7)C0	—	No fix listed	CNA

VMG3625-T50B firmware VendorZyxel Affected up to 5.50(ABPM.9.7)C0 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:o:zyxel:vmg3625-t50c_firmware::::::::	up to 5.50\(abpm.9.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3625-t50c:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:vmg3625-t50b_firmware::::::::	up to 5.50\(abpm.9.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg3625-t50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:emg5523-t50b_firmware::::::::	up to 5.50\(abpm.9.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:emg5523-t50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:emg3525-t50b_firmware::::::::	up to 5.50\(abpm.9.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:emg3525-t50b:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:dx5401-b1_firmware::::::::	up to 5.17\(abyo.7.1\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:dx5401-b1:-:::::::*	not specified by NVD	Running on	Zyxel

cpe:2.3:o:zyxel:vmg3625-t50c_firmware:*:*:*:*:*:*:*:* Versions up to 5.50\(abpm.9.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3625-t50c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:vmg3625-t50b_firmware:*:*:*:*:*:*:*:* Versions up to 5.50\(abpm.9.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg3625-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:emg5523-t50b_firmware:*:*:*:*:*:*:*:* Versions up to 5.50\(abpm.9.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:emg5523-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:emg3525-t50b_firmware:*:*:*:*:*:*:*:* Versions up to 5.50\(abpm.9.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:emg3525-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:dx5401-b1_firmware:*:*:*:*:*:*:*:* Versions up to 5.17\(abyo.7.1\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:dx5401-b1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:zyxel:vmg8623-t50b_firmware::::::::	up to 5.50\(abpm.9.7\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:vmg8623-t50b:-:::::::*	not specified by NVD	Running on	Zyxel

cpe:2.3:o:zyxel:vmg8623-t50b_firmware:*:*:*:*:*:*:*:* Versions up to 5.50\(abpm.9.7\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:vmg8623-t50b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-02-24
Zyxel VMG3625-T50B firmware — zyxel.com/global/en/support/security-advisories/zyxel-secur…
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2025-10863 NULL pointer dereference in Zyxel VMG3625-T50B firmwarePriority LOW 27
- TI-2025-10862 NULL pointer dereference in Zyxel VMG3625-T50B firmwarePriority LOW 26
- TI-2025-10861 NULL pointer dereference in Zyxel VMG3625-T50B firmwarePriority LOW 25
Show all 5 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-1459
2026-10-03 Alias added: GHSA-x6c4-87pg-m84f

References

Advisory 1

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

TI-2025-12742 OS command injection in Zyxel EX3301-T0 firmware CVSS 3.1HIGH 8.8
TI-2025-07956 OS command injection in Zyxel DX3300-T0 firmware CVSS 3.1HIGH 8.8
TI-2024-05028 Buffer overflow in Zyxel VMG8825-T50K firmware CVSS 3.1HIGH 7.5
TI-2025-05994 Uncontrolled resource consumption in Zyxel DX3301-T0 firmware CVSS 3.1HIGH 7.5
TI-2024-08115 Buffer overflow in Zyxel VMG8825-T50K firmware CVSS 3.1HIGH 7.5
TI-2026-01157 OS command injection in Zyxel DX3301-T0 firmware CVSS 3.1HIGH 7.2

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences