CVE-2022-26414

—

CVSS 3.1

5.5 medium

EPSS

<1%p11

Published

Apr 11, 2022 (Apr 11, 2022)

Modified

Jun 17, 2026

Description

A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, which could be exploited by a local authenticated attacker to cause a denial of service.

Vendors: zyxel
Products: vmg3312-t20a firmware, emg3525-t50b firmware, emg5523-t50b firmware, emg5723-t50k firmware, emg6726-b10a firmware, vmg1312-t20b firmware, vmg3625-t50b firmware, vmg3927-b50a firmware, vmg3927-b50b firmware, vmg3927-b60a firmware, vmg3927-t50k firmware, vmg4927-b50a firmware
Weakness: CWE-120
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news2 stories

Zyxel fixed firewall unauthenticated remote command injection issue

Security AffairsMay 17, 06:47 UTC · May 17, 2022Exploit / PoC CVE-2022-30525 CVE-2022-26413 CVE-2022-26414+1 CVEs

Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability

The Hacker NewsMay 15, 00:00 UTC · May 15, 2022Vulnerability in the wildCVE-2022-30525 CVE-2022-26413 CVE-2022-26414+1 CVEs