CVE-2022-26413

A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local…

High8.0EPSS 0.70%

Published: 11 Apr 2022
Updated: 3 Aug 2024
Reserved: 4 Mar 2022
Assigned by: Zyxel

Description

A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.

Scores

CVSS scores of CVE-2022-26413, by who scored it
Scored by	CVSS	Score	Vector
ZyxelCNA (assigner)	3.1	High8.0	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High8.0	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.70% · top 47% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.

Weakness

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Zyxel · VMG3312-T20A firmware
- affected V5.30(ABFX.5)C0

References (1)

https://www.zyxel.com/support/OS-command-injection-and-buffer-overflow-vulnerabilities-of-CPE-and-ONTs.shtml (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-26413](https://trackcve.app/badge/CVE-2022-26413.svg)](https://trackcve.app/cve/CVE-2022-26413)

Record last updated 3 Aug 2024, 05:03 UTC.