CVE-2026-1459 – This CVE describes a post-authentication comman... (How to Fix)

Q: What is the severity of CVE-2026-1459?

CVE-2026-1459 has a CVSS score of 7.2 (HIGH). This CVE describes a post-authentication command injection vulnerability in Zyxel VMG3625-T50B devices. An authenticated attacker with administrator privileges can execute arbitrary OS commands on affected devices running firmware versions through 5.50(ABPM.9.7)C0. This affects users of these specific Zyxel router models.

📋 TL;DR

This CVE describes a post-authentication command injection vulnerability in Zyxel VMG3625-T50B devices. An authenticated attacker with administrator privileges can execute arbitrary OS commands on affected devices running firmware versions through 5.50(ABPM.9.7)C0. This affects users of these specific Zyxel router models.

💻 Affected Systems

Products:

Zyxel VMG3625-T50B

Versions: Firmware versions through 5.50(ABPM.9.7)C0

Operating Systems: Embedded Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Requires administrator authentication to exploit. Affects TR-369 certificate download CGI program specifically.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, steal credentials, or use device as part of botnet.

🟠

Likely Case

Attacker with admin credentials gains full control of device, can modify configurations, intercept traffic, or disrupt network services.

🟢

If Mitigated

Limited impact if strong authentication controls prevent unauthorized admin access and network segmentation limits lateral movement.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires admin credentials but command injection is straightforward once authenticated.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firmware version after 5.50(ABPM.9.7)C0

Vendor Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

Restart Required: Yes

Instructions:

1. Log into Zyxel support portal. 2. Download latest firmware for VMG3625-T50B. 3. Upload firmware via web interface. 4. Apply update and restart device.

🔧 Temporary Workarounds

Restrict Admin Access

all

Limit administrative access to trusted IP addresses only

Configure firewall rules to restrict admin interface access

Disable TR-369

all

Disable TR-369 protocol if not required

Disable TR-369 in device configuration

🧯 If You Can't Patch

Implement strict network segmentation to isolate affected devices
Enforce strong password policies and multi-factor authentication for admin accounts

🔍 How to Verify

Check if Vulnerable:

Check firmware version via web interface: System Info > Firmware Version

Check Version:

Check web interface or use SNMP query for sysDescr

Verify Fix Applied:

Verify firmware version is newer than 5.50(ABPM.9.7)C0

📡 Detection & Monitoring

Log Indicators:

Unusual command execution in system logs
Multiple failed admin login attempts followed by successful login

Network Indicators:

Unusual outbound connections from router
Unexpected traffic patterns

SIEM Query:

source="router_logs" AND (event="command_execution" OR event="admin_login")

📊 Metadata

CVE ID: CVE-2026-1459

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: February 24, 2026

Last Updated: February 25, 2026

🔗 References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-1459, you might also want to check these: