PT-2026-21645 · Zyxel · Zyxel Vmg3625-T50B

Published 2026-02-24 · Updated 2026-03-01 · CVE-2026-1459

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0

Description A post-authentication command injection exists in the TR-369 certificate download CGI program. An authenticated attacker with administrator privileges could execute operating system (OS) commands on an affected device. The vulnerable component is the TR-369 certificate download CGI program.

Recommendations Versions prior to 5.50(ABPM.9.7)C0 should be updated.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-1459

Affected Products

Zyxel Vmg3625-T50B

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-1459 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1459 · Vendor Advisory
• https://twitter.com/Watchful_IP/status/2026292676832735376 · Twitter Post
• https://twitter.com/cybernewslive/status/2026830608769458652 · Twitter Post
• https://twitter.com/Watchful_IP/status/2026293796787442101 · Twitter Post
• https://twitter.com/eclypsium/status/2027459507912155563 · Twitter Post
• https://reddit.com/r/TechNadu/comments/1rffi6z/zyxel_critical_rce_alert_how_are_you_protecting · Reddit Post
• https://twitter.com/cracbot/status/2028062771657728418 · Twitter Post
• https://twitter.com/RedPacketSec/status/2026174768811053485 · Twitter Post
• https://t.me/cveNotify/152962 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1rfcoxa/zyxel_addresses_critical_vulnerability_in_device · Reddit Post
• https://t.me/CVEtracker/45563 · Telegram Post
• https://twitter.com/cracbot/status/2027700459801346309 · Twitter Post
• https://twitter.com/CVEnew/status/2026184601627185339 · Twitter Post