CVE-2026-1459Disclosure(zyxel / dx5401-b1)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch zyxel dx5401-b1 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

zyxel CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dx5401-b1
dx5401-b1_firmware
emg3525-t50b
emg3525-t50b_firmware

Threat summary

Patch or workaround signal is available
11 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 6 signals
Disclosure: 5 classified signals
General: 3 classified signals
Peaked 5d ago at 5 mentions (2026-02-24); latest day: 1
11 total mentions across 6 days

Affected systems

Vendors

zyxel

Products

dx5401-b1dx5401-b1_firmwareemg3525-t50bemg3525-t50b_firmwareemg5523-t50bemg5523-t50b_firmwarevmg3625-t50bvmg3625-t50b_firmwarevmg3625-t50cvmg3625-t50c_firmware

1 version affected across 12 products

Deep dive

Activity timeline11 mentions / 6d

Signal classification3 categories

Disclosure

545.5%

General

327.3%

Patch

327.3%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-24	5	Disclosure3General2
2026-02-25	1	Patch1
2026-02-26	1	Patch1
2026-02-27	2	General1Patch1
2026-02-28	1	Disclosure1
2026-03-01	1	Disclosure1

Full discourse11 posts

Watchful IP@Watchful_IP227d
General
@hacefresko Nice. My one for CVE-2026-1459 disclosed the same advisory is here. https://watchfulip.github.io/28-12-25/zyxel.html https://t.co/VoSzEaqzdm
Post summary
The tweet references CVE-2026-1459 and links to an advisory but offers no additional details or actionable information.
02011284
402 followersView on X
CRAC Learning - Tech@cracbot223d
Disclosure
CVE-2026-1459 (CVSS:7.2, HIGH) is Analyzed. A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG362..https://nvd.nist.gov/vuln/detail/CVE-2026-1459 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post highlights a high‑severity post‑authentication command injection flaw in Zyxel VMG362’s TR‑369 certificate download CGI, but provides no PoC, exploit, or patch details.
0000024
173 followersView on X
CRAC Learning - Tech@cracbot224d
Disclosure
CVE-2026-1459 (CVSS:7.2, HIGH) is Analyzed. A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG362..https://nvd.nist.gov/vuln/detail/CVE-2026-1459 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The tweet presents a brief analysis of CVE‑2026‑1459, stating its CVSS score and that it is a post‑authentication command injection in Zyxel’s TR‑369 CGI program, but it offers no evidence of exploitation, PoC, or patch information.
0000025
173 followersView on X
Eclypsium@eclypsium224d
Patch
Organizations using Zyxel products should prioritize installing the recommended patches and consider replacing any legacy devices that are no longer supported or have reached end-of-life status (CVE-2025-13943, CVE-2026-1459, CVE-2024-40891). https://hubs.ly/Q0451tTh0
Post summary
The advisory urges Zyxel users to apply patches for CVE-2025-13943, CVE-2026-1459, CVE-2024-40891 and consider replacing unsupported devices.
00000175
1.8K followersView on X
CERT-PY@CERTpy224d
General
⚠️ Vulnerabilidades en productos Zyxel ❗ CVE-2026-1459 ❗ CVE-2025-13943 ❗ CVE-2025-13942 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-zyxel-2/ https://t.co/Mm5XqgBCoc
Post summary
The message lists several Zyxel CVEs and links to external resources for more information, but does not include any technical details, exploits, patches, or evidence of active exploitation.
00000102
6.6K followersView on X
Cyber News Live@cybernewslive226d
Patch
Zyxel has released updates for over a dozen router models to fix a critical vulnerability, CVE-2025-13942, allowing remote command execution. While exploitation requires specific settings to be enabled, users should install the patches. Zyxel also addressed two high-severity flaws, CVE-2025-13943 and CVE-2026-1459, which require compromised credentials. If your Zyxel router model is end-of-life, Zyxel advises replacing it since no further patches will be issued. ⚠️ #CyberNewsLive https://bleepingcomputer.com/news/security/zyxel-warns-of-critical-rce-flaw-affecting-over-a-dozen-routers/
Post summary
Zyxel has issued patches for CVE‑2025‑13942 and related high‑severity flaws, urging users to update or replace end‑of‑life routers; no active exploitation or PoC is reported.
0000052
1.5K followersView on X
ThreatSynop@ThreatSynop226d
Patch
🚨 Critical Zyxel router UPnP command-injection flaw enables unauth remote OS command execution Zyxel patched CVE-2025-13942 (CVSS 9.8), a UPnP command-injection bug affecting 4G/5G CPE, DSL/Ethernet CPE, Fiber ONTs, and wireless extenders that can allow unauth attackers to run OS commands via crafted UPnP SOAP requests (only if WAN access and UPnP are enabled). Zyxel also disclosed additional DoS and post-auth command-injection issues (incl. CVE-2026-1459 / CVE-2025-13943), urging immediate firmware updates to prevent device takeover. 🎯 Target: Global/Telecom & Home Router Users #️⃣ Category: #Vulnerability #BlueTeam 🔗 URL: https://securityaffairs.com/188501/security/critical-zyxel-router-flaw-exposed-devices-to-remote-attacks.html
Post summary
Zyxel has patched a critical UPnP command‑injection flaw (CVE‑2025‑13942) that allows unauthenticated remote OS command execution; users are urged to apply firmware updates immediately.
0000070
214 followersView on X
Watchful IP@Watchful_IP227d
Disclosure
@0xor0ne Now issued CVE ID CVE-2026-1459 https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026
Post summary
The tweet announces the issuance of CVE‑2026‑1459 and links to a Zyxel security advisory, indicating a new vulnerability disclosure.
0000050
402 followersView on X
CVE@CVEnew228d
Disclosure
CVE-2026-1459 A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C… https://www.cve.org/CVERecord?id=CVE-2026-1459
Post summary
A post‑authentication command injection vulnerability exists in the TR‑369 certificate download CGI program of Zyxel VMG3625‑T50B firmware versions up to 5.50(ABPM.9.7)C.
0000081
56.5K followersView on X
OffSeq | Adversary Tactics for Cyber Resilience@offseq228d
Disclosure
🚨 New HIGH-severity OS command injection found in Zyxel VMG3625-T50B firmware (≤5.50(ABPM.9.7)C0). Admin access = full device compromise risk. Restrict admin access & monitor activity. Patch when available! https://radar.offseq.com/threat/cve-2026-1459-cwe-78-improper-neutrali... https://t.co/mu8IbMpBxy
Post summary
A high‑severity OS command injection vulnerability (CVE‑2026‑1459) was discovered in Zyxel VMG3625‑T50B firmware, posing a full device compromise risk; patching is advised.
0000036
269 followersView on X
RedPacket Security@RedPacketSec228d
General
CVE Alert: CVE-2026-1459 - Zyxel - VMG3625-T50B firmware - https://www.redpacketsecurity.com/cve-alert-cve-2026-1459-zyxel-vmg3625-t50b-firmware/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-1459 #zyxel #vmg3625-t50b-firmware
Post summary
The post announces a CVE alert for Zyxel VMG3625‑T50B firmware but provides no further details such as PoC, exploit, patch, or technical specifics.
00000101
3.5K followersView on X

CPE platform detail12 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

12 of 12 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	zyxel	dx5401-b1	-	-	-
OS	zyxel	dx5401-b1_firmware	-	-	-
HW	zyxel	emg3525-t50b	-	-	-
OS	zyxel	emg3525-t50b_firmware	-	-	-
HW	zyxel	emg5523-t50b	-	-	-
OS	zyxel	emg5523-t50b_firmware	-	-	-
HW	zyxel	vmg3625-t50b	-	-	-
OS	zyxel	vmg3625-t50b_firmware	-	-	-
HW	zyxel	vmg3625-t50c	-	-	-
OS	zyxel	vmg3625-t50c_firmware	-	-	-
HW	zyxel	vmg8623-t50b	-	-	-
OS	zyxel	vmg8623-t50b_firmware	-	-	-

Explore more

Back to dashboard zyxel CVEs dx5401-b1 vulnerabilities

What researchers are saying

CVE-2026-1459

Cyber News Live[verified]@cybernewslivePatch

Zyxel has issued patches for CVE‑2025‑13942 and related high‑severity flaws, urging users to update or replace end‑of‑life routers; no active exploitation or PoC is reported.

ThreatSynop[verified]@ThreatSynopPatch

Zyxel has patched a critical UPnP command‑injection flaw (CVE‑2025‑13942) that allows unauthenticated remote OS command execution; users are urged to apply firmware updates immediately.

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqDisclosure

A high‑severity OS command injection vulnerability (CVE‑2026‑1459) was discovered in Zyxel VMG3625‑T50B firmware, posing a full device compromise risk; patching is advised.

Watchful IP@Watchful_IPGeneral

The tweet references CVE-2026-1459 and links to an advisory but offers no additional details or actionable information.

CRAC Learning - Tech@cracbotDisclosure

The post highlights a high‑severity post‑authentication command injection flaw in Zyxel VMG362’s TR‑369 certificate download CGI, but provides no PoC, exploit, or patch details.

CRAC Learning - Tech@cracbotDisclosure

The tweet presents a brief analysis of CVE‑2026‑1459, stating its CVSS score and that it is a post‑authentication command injection in Zyxel’s TR‑369 CGI program, but it offers no evidence of exploitation, PoC, or patch information.

Eclypsium@eclypsiumPatch

The advisory urges Zyxel users to apply patches for CVE-2025-13943, CVE-2026-1459, CVE-2024-40891 and consider replacing unsupported devices.

CERT-PY@CERTpyGeneral

The message lists several Zyxel CVEs and links to external resources for more information, but does not include any technical details, exploits, patches, or evidence of active exploitation.