Zyxel Firewall Bug Turns an Admin Login Into Full Takeover

A heads-up, not a sales pitch

We keep an eye on the advisories that affect the kind of gear our customers actually run, and we pass on the ones worth knowing about — not to sell you anything, just because you'd want to hear it from someone paying attention. This one's about a Zyxel firewall bug, and it's a useful reminder about a part of network security that's easy to overlook: the admin account itself.

What happened, in plain English

On 4 August 2026, Zyxel published a security advisory for CVE-2026-14818, a path traversal vulnerability in the CLI command that ZLD firewall firmware uses to execute configuration files. In plain terms: on the affected models, that command doesn't properly restrict which file it's allowed to reach, so a crafted filename can point it outside the folder it's supposed to stay in — and get it to run a file it was never meant to touch.

Here's the important nuance, and it matters: this is not an anonymous, walk-in-from-the-internet bug. The CVSS vector confirms it needs PR:H — high privileges — meaning an attacker already has to be logged in with administrator access before they can exploit it. NVD scores it CVSS 3.1: 7.2 (High), under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). There's no indication in the advisory, or anywhere we could find, that this is currently being exploited in the wild, and it isn't on CISA's Known Exploited Vulnerabilities list. So: real bug, verified by Zyxel and NVD, but authenticated — don't let anyone tell you it's an open door from the internet.

The affected products are Zyxel's business firewall line running ZLD firmware:

• ATP series — ZLD V4.32 through V5.42 Patch 1
• USG FLEX series — ZLD V4.50 through V5.42 Patch 1
• USG FLEX 50(W) / USG20(W)-VPN — ZLD V4.16 through V5.42 Patch 1

Zyxel has released ZLD V5.43, which fixes the flaw, for all three lines.

Why it matters — even though you need to be an admin first

It's tempting to read "authentication required" as "not really a risk." That's the trap. Admin credentials get compromised all the time — reused passwords turning up in a breach dump, a phished support tech, a departed employee's login that never got revoked, a shared "admin/admin123" account nobody's rotated in years. None of that requires a zero-day. It just requires the everyday sloppiness that happens to admin accounts specifically, because they're used less often and watched less closely than customer-facing logins.

Once someone has that access, a bug like this is what turns "stolen admin password" into "full device takeover." A firewall's configuration file is about as sensitive as it gets — it controls firewall rules, VPN settings, routing, logging, everything. A malicious config pushed through this flaw could quietly open holes in your perimeter, redirect traffic, or plant persistence that survives a routine password reset. The firewall is meant to be the thing standing guard; a bug like this means the guard station itself can be repurposed if someone gets the keys.

The honest bit: no vendor is immune, including the ones we like

Zyxel makes solid, dependable gear that a lot of Australian small businesses run happily, and we're not going to pretend a bug like this changes that. Every serious vendor ships flaws — Cisco, Fortinet, Zyxel, all of them. We've said the same thing about our own preferred brands before, including in our FortiBleed writeup. The measure of a vendor isn't whether bugs happen; it's whether they disclose clearly and ship a fix — which Zyxel did here, cleanly and without drama.

One thing worth noting, lightly: on cloud-managed platforms, a fix like V5.43 gets pushed out automatically once you're on a supported release, so there's no window where a business simply forgets to install it. On a standalone ZLD box, that upgrade is a manual job someone has to actually schedule and do — which is exactly the kind of task that quietly slips.

What we'd suggest you actually do

No urgency, no upsell — just a sensible checklist:

1. Check what you're running. If you have a Zyxel ATP, USG FLEX, USG FLEX 50(W) or USG20(W)-VPN firewall, log in and check the firmware version.
2. If it's ZLD V5.42 Patch 1 or earlier, plan the upgrade to V5.43. It's a routine firmware update, not an emergency midnight job, but don't let it drift indefinitely either.
3. Take this as the nudge to audit admin accounts specifically — on this firewall and everywhere else. Unique credentials per admin (no shared logins), multi-factor authentication where the device supports it, and a quick check that nobody who's left the business still has access.
4. Restrict who can reach the admin interface and CLI at all. If remote management isn't something you actively need, turn it off or lock it to a management VLAN/VPN rather than leaving it reachable more broadly.
5. Review who actually holds admin rights. Config-file execution and restore functions are powerful — they don't need to be available to every account that happens to have "admin" ticked.

The friendly takeaway

This one's a good reminder that "you need to already be logged in" isn't the same as "you're safe" — because credentials leak, get reused, and get phished every day. Patch when V5.43 suits your schedule, and while you're in there, give the admin accounts on that firewall the same scrutiny you'd give the front door.

If you'd ever like a second pair of eyes on your Zyxel setup, or on admin account hygiene across your network more generally — no obligation, no hard sell — we're happy to help. That's what we're here for.

References

• Zyxel — Security advisory for path traversal vulnerability in the configuration file execution CLI command of ZLD firewalls (CVE-2026-14818)
• NVD — CVE-2026-14818 Detail