CVE-2026-13206
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
Zyxel Networks WAH7601 through 20072026 has an OS command injection vulnerability that allows an attacker to execute arbitrary commands on the system.
Risk Assessment
An attacker can take control of the device, potentially leading to network compromise and further attacks.
Recommendation
Update the device firmware to the latest available version that includes a fix.
Other vulnerabilities in Zyxel Networks WAH7601
See all- CVE-2026-6374High
Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601 through 20.07.2026.
- CVE-2026-6373Medium
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.
- CVE-2026-12984High
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601 through 20072026.
Original NVD description (English source)
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.