{"affected":[{"defaultStatus":"unaffected","product":"EX3501-T0 firmware","source":"CNA: Zyxel","vendor":"Zyxel","versions":[{"status":"affected","version":"<= 5.44(ACHR.6)C0"}]}],"cveId":"CVE-2026-12489","cwes":["CWE-863"],"description":"An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device.","epss":{"date":"2026-11-03","percentile":0.21654,"score":0.0029},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: Zyxel","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: security@zyxel.com.tw","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793751456609,"publishedAt":1792461889838,"references":[{"source":"CNA: Zyxel","tags":["vendor-advisory"],"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-authorization-vulnerability-in-the-dal-of-certain-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-10-20-2026"},{"source":"security@zyxel.com.tw","tags":[],"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-authorization-vulnerability-in-the-dal-of-certain-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-10-20-2026"}],"remediation":[],"revision":"214047166522d3800063cddf1c5b6c979f57451f5bbee581a8b1c7ada6cc4fa1","sources":[{"modifiedAt":1793751456609,"name":"CNA: Zyxel","retrievedAt":1793754656963,"url":"https://www.cve.org/CVERecord?id=CVE-2026-12489"},{"modifiedAt":1793747857910,"name":"NVD","retrievedAt":1793751472322,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12489"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748252416,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12489"}],"ssvc":{"assessedAt":1792554973657,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-12489","updatedAt":1793754656963}