Critical · 9.8 CVE-2026-24789 EUVD-2026-5941GHSA-r6ff-p4vx-28hv

ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function

Published Feb 11, 2026 · Updated Feb 11, 2026 · Assigned by icscert

Vendor: ZLAN Information Technology Co. Product: ZLAN5143D

Description

An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.

Affected products

Vendor	Product	Affected	Fixed
ZLAN Information Technology Co.	ZLAN5143D	v1.600	—

Advisories 1

ICSA-26-041-02 ZLAN Information Technology Co. ZLAN5143D CISA ICS & IT advisories · Feb 10, 2026

References