CVE-2022-26413

—

CVSS 3.1

8.0 high

EPSS

<1%p51

Published

Apr 11, 2022 (Apr 11, 2022)

Modified

Jun 17, 2026

Description

A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.

Vendors: zyxel
Products: vmg3312-t20a firmware, emg3525-t50b firmware, emg5523-t50b firmware, emg5723-t50k firmware, emg6726-b10a firmware, vmg1312-t20b firmware, vmg3625-t50b firmware, vmg3927-b50a firmware, vmg3927-b50b firmware, vmg3927-b60a firmware, vmg3927-t50k firmware, vmg4927-b50a firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news2 stories

Zyxel fixed firewall unauthenticated remote command injection issue

Security AffairsMay 17, 06:47 UTC · May 17, 2022Exploit / PoC CVE-2022-30525 CVE-2022-26413 CVE-2022-26414+1 CVEs

Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability

The Hacker NewsMay 15, 00:00 UTC · May 15, 2022Vulnerability in the wildCVE-2022-30525 CVE-2022-26413 CVE-2022-26414+1 CVEs