A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 24, 2026 · NIST NVD

   Detected

   A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

2. Jun 17, 2026 · NIST NVD

   Updated

   A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

Affected

• cpe zyxel/dx5401-b1 firmwareversion unspecified
• cpe zyxel/emg3525-t50b firmwareversion unspecified
• cpe zyxel/emg5523-t50b firmwareversion unspecified
• cpe zyxel/vmg3625-t50b firmwareversion unspecified
• cpe zyxel/vmg3625-t50c firmwareversion unspecified
• cpe zyxel/vmg8623-t50b firmwareversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2026-1459

  A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands

  nvd.nist.gov

References

• Vendor Advisory · zyxel.com