CVE-2024-9200: Zyxel EMG6726-b10a Firmware

High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days.

A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(ABQA.2.2)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.

Affected products

• Zyxel EMG6726-b10a Firmware: before 5.13\(abnp.8\)c1 (fixed in 5.13\(abnp.8\)c1)
• Zyxel VMG3927-b50b Firmware: before 5.13\(ably.9\)c1 (fixed in 5.13\(ably.9\)c1)
• Zyxel VMG4005-b50a Firmware: before 5.15\(abqa.2.3\)c0 (fixed in 5.15\(abqa.2.3\)c0)
• Zyxel VMG4005-b50b Firmware: before 5.13\(abrl.5.2\)c0 (fixed in 5.13\(abrl.5.2\)c0)
• Zyxel VMG4005-b60a Firmware: before 5.15\(abqa.2.3\)c0 (fixed in 5.15\(abqa.2.3\)c0)
• Zyxel VMG4927-b50a Firmware: before 5.13\(ably.9\)c1 (fixed in 5.13\(ably.9\)c1)

Published 2024-12-03. Last modified 2026-06-17.