High · 7.2 CVE-2024-12009 EUVD-2024-54137GHSA-h9wf-5xc8-6gmp

A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and …

Published Mar 11, 2025 · Updated Feb 26, 2026 · Assigned by Zyxel

Vendor: Zyxel Product: EX5601-T1 firmware Category: Network devices

Description

A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	EX5601-T1 firmware	<= V5.70(ACDZ.3.6)C0	—

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerabilities-in-certain-dsl-ethernet-cpe-fiber-ont-and-wifi-extender-devices-03-11-2025 vendor-advisory