The listed flaw is an incorrect authorization vulnerability in the Data Access Layer of Zyxel EX3501‑T0 firmware through version 5.44(ACHR.6)C0. It permits an attacker who has already authenticated to a device to modify the login_privilege data, increasing their privileges on the system. This vulnerability falls under incorrect authorization (CWE‑863) and can let a threat actor gain administrative control, with potential for further exploitation or persistence.

Zyxel EX3501‑T0 devices running firmware versions up to 5.44(ACHR.6)C0 are affected. No other vendors or products are listed in the CVE data.

The CVSS score of 6.5 indicates moderate severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, widespread exploitation cannot be ruled out, but the affinity is limited to devices that have been compromised by an authenticated attacker. The flaw requires the attacker to reach the device’s management interface, which may be reachable locally or remotely if remote management is enabled. Once access is gained, the attacker can elevate their privileges and potentially lock out other administrators.