CVSS Score v3.1
8.0
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.0063
70.7th percentile
Risk Priority
16
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2022-26413 is a high-severity OS Command Injection (CWE-78) vulnerability in Zyxel Emg3525-T50B Firmware . Its CVSS base score is 8.0 (High).
Operationally, ranked in the top 29.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Vulnerability
Related Threats
Affected Assets
Mitigating Controls
Vulnerability details
A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.
CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
zyxel
vmg3312-t20a firmware
5.30\(abfx.5\)c0
zyxel
emg3525-t50b firmware
≤ 5.50\(abpm.6\)c0 · ≤ 5.50\(abpm.6\)c0
zyxel
emg5523-t50b firmware
≤ 5.50\(abpm.6\)c0 · ≤ 5.50\(abpm.6\)c0
zyxel
emg5723-t50k firmware
≤ 5.50\(abom.7\)c0
zyxel
emg6726-b10a firmware
≤ 5.13\(abnp.7\)c0
zyxel
vmg1312-t20b firmware
≤ 5.50\(absb.5\)c0
zyxel
vmg3625-t50b firmware
≤ 5.50\(abpm.6\)c0
zyxel
vmg3927-b50a firmware
≤ 5.17\(abmt.6\)c0
zyxel
vmg3927-b50b firmware
≤ 5.13\(ably.7\)c0
zyxel
vmg3927-b60a firmware
≤ 5.17\(abmt.6\)c0
+22 more product configuration(s) — see NVD for full list
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Validates inputs to block special elements that would alter OS command execution.