CVE-2026-24789

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24789", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-01-29T21:07:29.858Z", "datePublished": "2026-02-11T16:17:19.702Z", "dateUpdated": "2026-02-11T16:45:23.479Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ZLAN5143D", "vendor": "ZLAN Information Technology Co.", "versions": [{"status": "affected", "version": "v1.600"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Shorabh Karir and Deepak Singh of KPMG reported these vulnerabilities to CISA"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication."}], "value": "An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-11T16:24:41.818Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-041-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-041-02.json"}, {"url": "https://www.zlmcu.com/en/contact_us.htm"}], "source": {"advisory": "ICSA-26-041-02", "discovery": "EXTERNAL"}, "title": "ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "ZLAN Information Technology Co. did not respond to CISA's attempts at \ncoordination. Users of ZLAN5143D devices are encouraged to contact ZLAN \nand keep their systems up to date. \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.zlmcu.com/en/contatct_us.htm\">https://www.zlmcu.com/en/contatct_us.htm</a>\n\n<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.zlmcu.com/en/contatct_us.htm\"></a>\n\n<br>"}], "value": "ZLAN Information Technology Co. did not respond to CISA's attempts at \ncoordination. Users of ZLAN5143D devices are encouraged to contact ZLAN \nand keep their systems up to date. \n https://www.zlmcu.com/en/contatct_us.htm \n\n https://www.zlmcu.com/en/contatct_us.htm"}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T16:44:50.414629Z", "id": "CVE-2026-24789", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T16:45:23.479Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24789", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T16:44:50.414629Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T16:45:13.239Z"}}], "cna": {"title": "ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function", "source": {"advisory": "ICSA-26-041-02", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Shorabh Karir and Deepak Singh of KPMG reported these vulnerabilities to CISA"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ZLAN Information Technology Co.", "product": "ZLAN5143D", "versions": [{"status": "affected", "version": "v1.600"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-041-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-041-02.json"}, {"url": "https://www.zlmcu.com/en/contact_us.htm"}], "workarounds": [{"lang": "en", "value": "ZLAN Information Technology Co. did not respond to CISA's attempts at \ncoordination. Users of ZLAN5143D devices are encouraged to contact ZLAN \nand keep their systems up to date. \n https://www.zlmcu.com/en/contatct_us.htm \n\n https://www.zlmcu.com/en/contatct_us.htm", "supportingMedia": [{"type": "text/html", "value": "ZLAN Information Technology Co. did not respond to CISA's attempts at \ncoordination. Users of ZLAN5143D devices are encouraged to contact ZLAN \nand keep their systems up to date. \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.zlmcu.com/en/contatct_us.htm\">https://www.zlmcu.com/en/contatct_us.htm</a>\n\n<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.zlmcu.com/en/contatct_us.htm\"></a>\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.", "supportingMedia": [{"type": "text/html", "value": "An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-11T16:24:41.818Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24789", "state": "PUBLISHED", "dateUpdated": "2026-02-11T16:45:23.479Z", "dateReserved": "2026-01-29T21:07:29.858Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-11T16:17:19.702Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ZLAN5143D", "vendor": "ZLAN Information Technology Co.", "versions": [{"status": "affected", "version": "v1.600"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication."}, {"lang": "es", "value": "Un punto final de API desprotegido permite a un atacante cambiar remotamente la contrase\u00f1a del dispositivo sin proporcionar autenticaci\u00f3n."}], "id": "CVE-2026-24789", "lastModified": "2026-06-17T10:23:35.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24789", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T16:44:50.414629Z", "version": "2.0.3"}}]}, "published": "2026-02-11T17:16:13.040", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-041-02.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-041-02"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.zlmcu.com/en/contact_us.htm"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.600"}}], "product": "zlan5143d", "vendor": "zlan_information_technology_co."}], "analysis": {"en": {"generated_at": "2026-04-18T12:40:03.465247+00:00", "value": {"mitigation_remediation": ["Contact ZLAN Information Technology Co. to request a firmware or configuration update that protects the exposed API.", "If the device firmware allows configuration changes, disable or restrict the vulnerable API endpoint so that only authenticated users can alter passwords.", "Isolate the ZLAN5143D device from critical networks via firewall or segmentation to limit potential damage.", "Monitor network traffic for anomalous API calls and investigate any unauthorized activity.", "Keep the device firmware up to date and apply future patches promptly."], "summary": {"action": "Contact Vendor", "impact": "Remote Password Change"}, "threat_synthesis": {"affected_systems": "The ZLAN5143D device manufactured by ZLAN Information Technology Co. is affected. No specific firmware versions are listed; therefore, all installations of this model are considered vulnerable until a patch is released.", "description_and_impact": "An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication. This missing authentication flaw permits unauthorized credential alteration, potentially leading to full control over the device and any connected systems.", "risk_and_exploitability": "The vulnerability is rated with a CVSS score of 9.3, indicating a high severity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the CVE is not listed in the CISA KEV catalog. Nevertheless, attackers could remotely invoke the vulnerable API over the network, modify the password, and gain full administrative access to the device."}}}}, "created": "2026-02-11T21:37:47.666964+00:00", "updated": "2026-04-18T12:45:45.670133+00:00", "vendors": ["zlan_information_technology_co.", "zlan_information_technology_co.$PRODUCT$zlan5143d"]}