Zyxel security advisory for incorrect authorization vulnerability in the DAL of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders

CVE: CVE-2026-12489

Summary

Zyxel has released patches for specific firmware versions of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders to address an incorrect authorization vulnerability in the Data Access Layer (DAL). Users are strongly advised to install these patches to ensure optimal protection.

What is the vulnerability?

The incorrect authorization vulnerability in the DAL of certain firmware versions for 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders could allow an authenticated attacker to elevate privileges by modifying the login_privilege data on an affected device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we identified the affected products still within their vulnerability support period and released firmware patches to address the issue, as shown in the table below. Please note that the table does not include customized models specifically designed for ISP customers. Any product currently on the market that is not listed in the table is not affected.

Got a question?

For our ISP customers, please contact your Zyxel sales or service representatives for more information. For customers who have acquired Zyxel devices through an ISP, please directly contact your ISP's support team, as the devices may have custom configurations.

Revision history

2026-10-20: Initial release