CVE-2026-14818: Zyxel Firewall Path Traversal Vulnerability

CVE-2026-14818 Overview

CVE-2026-14818 is a path traversal vulnerability [CWE-22] in the command-line interface (CLI) command used to execute configuration files on Zyxel ZLD-based firewalls. An authenticated attacker holding administrator privileges can supply a crafted path that escapes the intended configuration directory and execute a malicious configuration file on the device. The flaw affects Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN firmware families across multiple firmware branches through V5.42 Patch 1. Zyxel published a security advisory on August 4, 2026 identifying the affected versions and remediation guidance.

Critical Impact
An authenticated administrator can execute an arbitrary configuration file resident on the device, resulting in high impact to confidentiality, integrity, and availability of the firewall.

Affected Products

Zyxel ATP series firmware V4.32 through V5.42 Patch 1
Zyxel USG FLEX series firmware V4.50 through V5.42 Patch 1
Zyxel USG FLEX 50(W) series firmware V4.16 through V5.42 Patch 1, and USG20(W)-VPN series firmware V4.16 through V5.42 Patch 1

Discovery Timeline

2026-08-04 - CVE-2026-14818 published to NVD
2026-08-04 - Zyxel publishes security advisory for the affected ZLD firewall series
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-14818

Vulnerability Analysis

The vulnerability resides in a CLI command that loads and executes configuration files on ZLD-based firewalls. The command accepts a file path argument but fails to canonicalize or validate the input against the intended configuration directory. An authenticated administrator can supply relative path sequences to reference files outside the expected location.

When the crafted path resolves to an attacker-controlled configuration file, the device parses and applies the file's directives. Because configuration files can define runtime behavior, routing, and administrative accounts, execution of an unintended file translates into broad control over firewall operation. The Common Weakness Enumeration classifies this issue as CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The CLI handler for configuration file execution does not enforce a strict allow-list or path canonicalization on the supplied filename. Relative traversal sequences such as ../ are processed by the underlying filesystem call rather than rejected during input validation.

Attack Vector

Exploitation requires network access to the management interface and valid administrator credentials. The attacker must first stage or identify a malicious configuration file reachable through the traversal path, then invoke the vulnerable CLI command to load it. Successful exploitation applies the crafted configuration on the affected device.

No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS score is 0.359% as of August 6, 2026.

See the Zyxel Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-14818

Indicators of Compromise

CLI audit log entries showing configuration execution commands referencing paths with ../ traversal sequences or absolute paths outside the standard configuration directory.
Unexpected changes to firewall running configuration, administrator accounts, routing tables, or firewall policies following administrator sessions.
New or modified configuration files present in non-standard directories on the device filesystem.

Detection Strategies

Enable and forward CLI command auditing from ZLD firewalls to a central log store, and alert on configuration execution commands that include path traversal characters.
Baseline firewall configuration state and detect drift between snapshots, focusing on administrator accounts, VPN policies, and management access rules.
Correlate administrator logins from unusual source addresses or outside change windows with subsequent configuration file execution commands.

Monitoring Recommendations

Forward Zyxel syslog and CLI audit output into a centralized SIEM or data lake to preserve command history beyond on-device retention limits.
Monitor administrative authentication events for brute force, credential reuse, or session anomalies that could precede exploitation.
Alert on firmware version reporting to identify devices still running vulnerable branches after the patch window closes.

How to Mitigate CVE-2026-14818

Immediate Actions Required

Apply the Zyxel-provided firmware update for each affected series as listed in the vendor advisory.
Restrict firewall management interfaces to trusted management networks and remove any exposure to untrusted networks or the internet.
Rotate all administrator credentials and review administrator account inventory for unauthorized additions.
Review recent CLI audit logs for configuration execution commands invoked with suspicious paths and validate the current running configuration against a known-good baseline.

Patch Information

Zyxel released fixed firmware for the ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series. Refer to the Zyxel Security Advisory for the specific patched firmware versions applicable to each product line and firmware branch.

Workarounds

Limit administrator account issuance and enforce multi-factor authentication for management access where supported.
Disable remote administrative access from WAN interfaces and restrict SSH and web management access to specific source IP allow-lists.
Enforce role separation so operational staff do not hold full administrator privileges required to invoke the vulnerable CLI command.

bash

# Example: restrict management access to a trusted subnet on ZLD firewalls
configure terminal
ip http server table admin rule 1 access-group TRUSTED_MGMT
ip ssh server rule 1 access-group TRUSTED_MGMT
write