Zyxel security advisory for incorrect authorization vulnerability in the DAL of certain 5G NR......

Options
Zyxel_May
Zyxel_May Posts: 278
First Comment Sixth Anniversary
image  Zyxel Employee
edited October 20 in Security Advisories

Zyxel security advisory for incorrect authorization vulnerability in the DAL of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders

CVE:CVE-2026-12489

Summary

Zyxel has released patches for specific firmware versions of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders to address an incorrect authorization vulnerability in the Data Access Layer (DAL). Users are strongly advised to install these patches to ensure optimal protection.

What is the vulnerability?

The incorrect authorization vulnerability in the DAL of certain firmware versions for 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders could allow an authenticated attacker to elevate privileges by modifying the login_privilege data on an affected device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we identified the affected products still within their vulnerability support period and released firmware patches to address the issue, as shown in the table below. Please note that the table does not include customized models specifically designed for ISP customers. Any product currently on the market that is not listed in the table is not affected.

Product

Affected model

Affected version

Patch availability*

5G NR CPE

NR5111

1.00(ACMP.3)C0

1.00(ACMP.4)C0

NR5307

2.00(ACJT.3)C0

2.00(ACJT.4)b1

NR5309

1.00(ACKP.2)b2

1.00(ACKP.2)b3

NR5313

1.00(ACRC.0)b4

1.00(ACRC.1)b1

NR7302

1.00(ACHA.6)C0

1.00(ACHA.7)b2

NR7303

1.00(ACEI.3)C0

1.00(ACEI.4)C0

NR7305

1.00(ACMM.2)b1

1.00(ACMM.3)C0

NR7307

1.00(ACTO.0)b1

1.00(ACTO.0)C0

NR7701

1.00(ACPK.1)b2

1.00(ACPK.1)b3

Nebula FWA505v2

1.70(ACRH.0)C0 and earlier

1.70(ACRH.0)V0

Nebula FWA515

1.70(ACPZ.1)C0 and earlier

1.70(ACPZ.0)V0

Nebula FWA70

1.70(ACRF.0)C0 and earlier

1.70(ACRF.0)V0

DSL/Ethernet CPE

DX3300-T0

5.50(ABVY.8.2)C0 and earlier

5.50(ABVY.8.3)C0

DX3300-T1

5.50(ABVY.8.2)C0 and earlier

5.50(ABVY.8.3)C0

DX3301-T0

5.50(ABVY.8.2)C0 and earlier

5.50(ABVY.8.3)C0

DX4510-B0

5.17(ABYL.10.3)C0

5.17(ABYL.10.4)C0

DX4510-B1

5.17(ABYL.10.3)C0

5.17(ABYL.10.4)C0

DX5401-B1

5.17(ABYO.7.3)C0 and earlier

5.17(ABYO.7.4)C0

EE3301-00

5.63(ACMU.3.2)C0 and earlier

5.63(ACMU.3.3)C0

EE5301-00

5.63(ACLD.3.2)C0 and earlier

5.63(ACLD.3.3)C0

EE6510-10

5.19(ACJQ.4.3) C0

5.19(ACJQ.4.4) C0

EMG3525-T50B

5.50(ABPM.9.10)C0 and earlier

5.50(ABPM.9.11)C0

EMG5523-T50B

5.50(ABPM.9.10)C0 and earlier

5.50(ABPM.9.11)C0

EX2210-T0

5.50(ACDI.2.6)C0

5.50(ACDI.2.7)C0

EX3300-T0

5.50(ABVY.8.2)C0 and earlier

5.50(ABVY.8.3)C0

EX3300-T1

5.50(ABVY.8.2)C0 and earlier

5.50(ABVY.8.3)C0

EX3301-T0

5.50(ABVY.8.2)C0 and earlier

5.50(ABVY.8.3)C0

EX3500-T0

5.44(ACHR.6)C0 and earlier

5.44(ACHR.6.1)C0

EX3501-T0

5.44(ACHR.6)C0 and earlier

5.44(ACHR.6.1)C0

EX3510-B0

5.17(ABUP.15.3)C0

5.17(ABUP.15.4)C0

EX3510-B1

5.17(ABUP.15.3)C0

5.17(ABUP.15.4)C0

EX3600-T0

5.70(ACIF.3.2)C0 and earlier

5.70(ACIF.3.3)C0

EX5401-B1

5.17(ABYO.7.3)C0 and earlier

5.17(ABYO.7.4)C0

EX5510-B0

5.17(ABQX.11.2)C0

5.17(ABQX.11.3)C0

EX5512-T0

5.70(ACEG.5.7)C0

5.70(ACEG.5.8)C0

EX5601-T0

5.70(ACDZ.6.2)C0 and earlier

5.70(ACDZ.6.3)C0

EX5601-T1

5.70(ACDZ.6.2)C0 and earlier

5.70(ACDZ.6.3)C0

EX7501-B0

5.18(ACHN.3.3)C0 and earlier

5.18(ACHN.3.4)C0

EX7710-B0

5.18(ACAK.1.8)C0

5.18(ACAK.1.9)C0

GM4100-B0

5.18(ACCL.2.2)C0 and earlier

5.18(ACCL.3)C0

VMG3625-T50B

5.50(ABPM.9.10)C0 and earlier

5.50(ABPM.9.11)C0

VMG4005-B50A

5.17(ABQA.3.4)C0 and earlier

5.17(ABQA.3.5)C0

VMG4005-B60A

5.17(ABQA.3.4)C0 and earlier

5.17(ABQA.3.5)C0

VMG8623-T50B

5.50(ABPM.9.10)C0 and earlier

5.50(ABPM.9.11)C0

Fiber ONTs

AM7510-00

5.63(ACOR.0.3)C0 and earlier

5.63(ACOR.0.4)C0

AX7501-B1

5.17(ABPC.8)C0 and earlier

5.17(ABPC.8.1)C0

PE3301-00

5.63(ACMT.3.2)C0 and earlier

5.63(ACMT.3.3)C0

PE5301-01

5.63(ACOJ.3.2)C0 and earlier

5.63(ACOJ.3.3)C0

PM3100-T0

5.42(ACBF.4.4)C0 and earlier

5.42(ACBF.4.5)C0

PM5100-T0

5.42(ACBF.4.4)C0 and earlier

5.42(ACBF.4.5)C0

PM5100-T1

5.42(ACBF.4.4)C0 and earlier

5.42(ACBF.4.5)C0

PM7300-T0

5.42(ABYY.4.2)C0 and earlier

5.42(ABYY.4.3)C0

PM7500-00

5.61(ACKK.1.5)C0 and earlier

5.61(ACKK.1.6)C0

PX5301-T0

5.44(ACKB.0.8)C0 and earlier

5.44(ACKB.0.9)C0

Wireless Extenders

WE3300-00

5.70(ACKA.2.1)C0 and earlier

5.70(ACKA.2.2)C0

WX3100-T0

5.50(ABVL.5.1)C0 and earlier

5.50(ABVL.5.2)C0

WX5600-T0

5.70(ACEB.6.2)C0 and earlier

5.70(ACEB.6.4)C0

WX5610-B0

5.18(ACGJ.0.5)C0

5.18(ACGJ.0.6)C0

* Please contact your Zyxel sales representative or support team to obtain the file.

For ISPs, please contact your Zyxel sales or service representatives for further details.

For end-users who acquired their Zyxel device from an ISP, we recommend reaching out directly to the ISP's support team, as the device may have custom-built settings.

For end-users who purchased their Zyxel device themselves, please contact your local Zyxel support team for the new firmware file to ensure optimal protection, or visit Zyxel's Community for further assistance.

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.

Revision history

2026-10-20: Initial release

Categories

EnglishTiếng ViệtРусскийไทย中文（台灣）