Unauthenticated API Vulnerability in ZLMCU Devices
CVE-2026-24789

9.3CRITICAL

Key Information:

Vendor

Zlan Information Technology Co.

Status
Zlan5143d
Vendor
CVE Published:
11 February 2026

What is CVE-2026-24789?

An unprotected API endpoint in ZLMCU devices exposes a critical security flaw, allowing attackers to change device passwords remotely without the need for any authentication. This vulnerability enables unauthorized access under certain conditions, threatening the integrity and security of the devices involved. Organizations utilizing ZLMCU products must take immediate action to secure their systems against potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ZLAN5143D v1.600

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...
https://www.zlmcu.com/en/contact_us.htm

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shorabh Karir and Deepak Singh of KPMG reported these vulnerabilities to CISA
JSON
.