ZLAN Information Technology Co. ZLAN5143D

Summary

Vulnerabilities 2

• Critical 9.8
  CVE-2026-24789

  ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function

  An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.

  ZLAN Information Technology Co. ZLAN5143D
  Feb 11, 2026
• Critical 9.8
  CVE-2026-25084

  ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function

  Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.

  ZLAN Information Technology Co. ZLAN5143D
  Feb 11, 2026

Revision history

1. 2026-02-10 #1

   Initial Publication

References

• ICSA Advisory ICSA-26-041-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-041-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks