CVE-2022-26413: OS Command Injection

Q: What is the severity of CVE-2022-26413?

CVE-2022-26413 has a high severity rating due to its potential to allow local authenticated attackers to execute arbitrary OS commands.

Q: How do I fix CVE-2022-26413?

To fix CVE-2022-26413, it is recommended to update the Zyxel VMG3312-T20A firmware to a version that is not vulnerable.

Q: What devices are affected by CVE-2022-26413?

CVE-2022-26413 specifically affects Zyxel VMG3312-T20A devices running firmware version 5.30(ABFX.5)C0.

Q: Can I exploit CVE-2022-26413 remotely?

No, CVE-2022-26413 requires local authenticated access to exploit the vulnerability.

Q: What types of attacks can be performed using CVE-2022-26413?

CVE-2022-26413 allows attackers to execute arbitrary OS commands on the affected device, which could lead to further system compromise.

Published Apr 11, 2022

Updated

A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.

Affected Software

66 affected components

Zyxel VMG3312-T20A firmware=5.30\(abfx.5\)c0

Zyxel VMG3312-T20A

Zyxel Emg3525-t50b Firmware<5.50\(abpm.6\)c0

Zyxel Emg3525-t50b

Zyxel Emg5523-t50b Firmware<5.50\(abpm.6\)c0

Zyxel Emg5523-t50b

Zyxel Emg5723-t50k Firmware<5.50\(abom.7\)c0

Zyxel Emg5723-t50k

Zyxel Emg6726-b10a Firmware<5.13\(abnp.7\)c0

Zyxel Emg6726-b10a

Zyxel Vmg1312-t20b Firmware<5.50\(absb.5\)c0

Zyxel Vmg1312-t20b

Zyxel VMG3625-T50B firmware<5.50\(abpm.6\)c0

Zyxel VMG3625-T50B

Zyxel Vmg3927-b50a Firmware<5.17\(abmt.6\)c0

Zyxel Vmg3927-b50a

Zyxel Vmg3927-b50b Firmware<5.13\(ably.7\)c0

Zyxel Vmg3927-b50b

Zyxel Vmg3927-b60a Firmware<5.17\(abmt.6\)c0

Zyxel Vmg3927-b60a

Zyxel Vmg3927-t50k Firmware<5.50\(abom.7\)c0

Zyxel Vmg3927-t50k

Zyxel Vmg4927-b50a Firmware<5.13\(ably.7\)c0

Zyxel Vmg4927-b50a

Zyxel Vmg8623-t50b Firmware<5.50\(abpm.6\)c0

Zyxel Vmg8623-t50b

Zyxel Vmg8825-b50a Firmware<5.17\(abmt.6\)c0

Zyxel Vmg8825-b50a

Zyxel Vmg8825-b50b Firmware<5.17\(abny.7\)c0

Zyxel Vmg8825-b50b

Zyxel VMG8825-T50K firmware<5.50\(abom.7\)c0

Zyxel VMG8825-T50K

Zyxel Vmg8825-b60a Firmware<5.17\(abmt.6\)c0

Zyxel Vmg8825-b60a

Zyxel Vmg8825-b60b Firmware<5.17\(abny.7\)c0

Zyxel Vmg8825-b60b

Zyxel Xmg3927-b50a Firmware<5.17\(abmt.6\)c0

Zyxel Xmg3927-b50a

Zyxel Xmg8825-b50a Firmware<5.17\(abmt.6\)c0

Zyxel Xmg8825-b50a

Zyxel DX5401-B0 firmware<5.17\(abyo.1\)c0

Zyxel DX5401-B0

Zyxel EX3510-B0 firmware<5.17\(abup.4\)c1

Zyxel EX3510-B0

Zyxel Ex5401-b0 Firmware<5.17\(abyo.1\)c0

Zyxel Ex5401-b0

Zyxel Ex5501-b0 Firmware<5.17\(abry.2\)c0

Zyxel Ex5501-b0

Zyxel AX7501-B0 firmware<5.17\(abpc.1\)c0

Zyxel AX7501-B0

Zyxel Ep240p Firmware<5.40\(abh.0\)c0

Zyxel Ep240p

Zyxel Pm7300-t0 Firmware<5.42\(acbc.1\)c0

Zyxel Pm7300-t0

Zyxel Pmg5317-t20b Firmware<5.40\(abki.4\)c0

Zyxel Pmg5317-t20b

Zyxel Pmg5617ga Firmware<5.40\(abna.2\)c0

Zyxel Pmg5617ga

Zyxel Pmg5617-t20b2 Firmware<5.41\(acbb.1\)c0

Zyxel Pmg5617-t20b2

Zyxel Pmg5622ga Firmware<5.40\(abnb.2\)c0

Zyxel Pmg5622ga

Zyxel Px7501-b0 Firmware<5.17\(abpc.1\)c0

Zyxel Px7501-b0

Event History

Apr 11, 2022

CVE Published

via MITRE·12:00 PM

Data Sourced

via MITRE·12:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-26413?

CVE-2022-26413 has a high severity rating due to its potential to allow local authenticated attackers to execute arbitrary OS commands.

How do I fix CVE-2022-26413?

To fix CVE-2022-26413, it is recommended to update the Zyxel VMG3312-T20A firmware to a version that is not vulnerable.

What devices are affected by CVE-2022-26413?

CVE-2022-26413 specifically affects Zyxel VMG3312-T20A devices running firmware version 5.30(ABFX.5)C0.

Can I exploit CVE-2022-26413 remotely?

No, CVE-2022-26413 requires local authenticated access to exploit the vulnerability.

What types of attacks can be performed using CVE-2022-26413?