The vulnerability allows an attacker who has successfully authenticated with administrative privileges on the Zyxel VMG3625‑T50B device to execute arbitrary operating system commands. Because the flaw is a classic OS command injection, the attacker could modify, delete, or exfiltrate system files, install backdoors, or otherwise take full control of the device. The weakness falls under CWE‑78 and carries a CVSS score of 7.2, indicating a high severity level that can compromise the confidentiality, integrity, and availability of the network device and any services dependent on it.

Zyxel routers including the VMG3625‑T50B firmware versions up to 5.50(ABPM.9.7)C0. The issue is tied to the TR‑369 certificate download CGI program and affects devices that are running the aforementioned firmware without applied vendor updates.

The vulnerability is exploitable only after the attacker has obtained valid administrator credentials, which implies a post‑authentication attack vector. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, because an attacker can achieve complete control over the device, the risk remains significant. The primary conditions for exploitation are network access to the device and possession of administrative authentication. No additional prerequisites such as privilege escalation or local physical access are required once the credentials are in hand.