CVE-2026-12489CWE-863broken-access-control

CVE-2026-12489

Medium · published October 20, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-20T07:17Z
References (1)
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-authorization-vulnerability-in-the-dal-of-certain-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-10-20-2026 · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 20 OCT 02:04Z
    An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an…
    cvelistv5
  • 20 OCT 02:04Z
    An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an…
    cvelistv5