CVE-2026-6837

HighCVSS 7.2

Published: 04/08/2026(UTC)Updated: 05/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.95%

58th percentile - higher than 58% of all known CVEs

Summary

In Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0, a post-authentication command injection vulnerability exists in the "export-cgi" CGI program. An authenticated attacker with administrator privileges can execute OS commands on the device.

Risk Assessment

An attacker with administrator privileges can gain full control of the device, potentially leading to network security compromise.

Recommendation

Update Zyxel WAX650S firmware to a version newer than 7.10(ABRM.4)C0 that includes the fix.

Other vulnerabilities in Zyxel WAX650S

CVE-2026-8508Medium
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.

Original NVD description (English source)

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.