This vulnerability (CVE-2026-14818) involves improper limitation of a pathname to a restricted directory (CWE-22) in Zyxel ATP series and related firmware. An authenticated attacker with administrator privileges can exploit a path traversal flaw in the CLI command responsible for executing configuration files. By crafting a malicious configuration file, the attacker could execute arbitrary code on the affected device. The affected firmware versions span multiple Zyxel product lines and specific version ranges as described. The vulnerability has a high CVSS score (7.2) due to network attack vector, low attack complexity, required high privileges, and high impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches have been reported as of the published date.

An authenticated administrator on an affected Zyxel device could exploit this vulnerability to execute arbitrary malicious configuration files, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could allow unauthorized code execution or configuration changes on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to configuration file execution. Do not deploy untrusted configuration files on affected devices.