Zyxel Patches Critical Command Injection Vulnerability in 18 Access Point Models

Key Takeaways

• Zyxel has addressed a critical command injection vulnerability, identified as CVE-2026-6837, impacting 18 models of its wireless access points.
• The flaw, located in the export-cgi component, could allow an authenticated administrator to execute arbitrary operating system commands.
• Successful exploitation could lead to full device compromise with root-level privileges.
• Firmware updates, specifically version 7.12 builds, are now available to mitigate the risk.

Zyxel Patches Critical Command Injection Flaw in Access Points

Zyxel has issued urgent firmware updates to resolve a high-severity command injection vulnerability, CVE-2026-6837, that affects nearly two dozen of its wireless access point (AP) models. This critical flaw could enable an authenticated attacker to execute arbitrary operating system commands on vulnerable devices.

Technical Breakdown of CVE-2026-6837

The vulnerability resides within the export-cgi component, specifically during the PKCS#12 certificate export process. Security researcher Mina Nageh Salama identified that the certificate export password parameter was susceptible to command injection due to inadequate handling of arguments. This allowed for the insertion of shell metacharacters into a command without proper sanitization.

An attacker who has already obtained a valid administrator session could craft malicious input to escape the intended command context. This would enable them to inject and execute additional commands on the device. Technical analysis of Zyxel WAX650S firmware version 7.10(ABRM.4)C0 revealed that the export-cgi utility constructed a command string incorporating certificate-export values before passing it directly to the system shell. This unsafe design permitted shell metacharacters, such as quotation marks, to alter the original command structure. Given that the CGI process operates with elevated privileges, a successful exploit could grant root-level operating system command execution to an attacker.

Vulnerability Classification and Impact

The vulnerability is categorized as CWE-78: Improper Neutralization of Special Elements used in an OS Command. The National Vulnerability Database (NVD) notes that this is a post-authentication issue, meaning an attacker must first gain administrator-level access to the access point. Despite this prerequisite, the potential impact is severe. A compromised administrator account, the reuse of credentials, an exposed management interface, or a malicious insider could leverage this bug to achieve complete control over the affected device.

According to researcher Mina Nageh Salama, reports indicate that a proof of concept for this vulnerability was successfully reproduced in a fully emulated WAX650S user-space environment, rather than requiring physical hardware. The research methodology involved extracting AArch64 firmware, utilizing qemu-aarch64-static, Bubblewrap, Python, and Bash, alongside a recreated web-handler environment. This setup allowed the analyst to access the Lighttpd and export-cgi request path, initialize necessary IPC services, and observe command output returned via HTTP responses.

Affected Models and Patch Availability

Zyxel has confirmed that 18 access point models are impacted by this vulnerability. The affected devices include: NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E.

The vendor’s security advisory, dated August 4, 2026, specifies that firmware 7.12 builds are the corrective release line for these models. Specifically, administrators of WAX650S devices should update to version 7.12(ABRM.0)C0. Full details can be found in the Zyxel security advisory.

What You Should Do

• Identify Affected Devices: Promptly locate all Zyxel APs within your network to determine if they are among the 18 models listed as vulnerable.
• Apply Firmware Updates: Immediately apply the corresponding firmware updates to all affected devices. Ensure you are updating to firmware 7.12 builds or later, as specified by Zyxel.
• Secure Management Interfaces: Verify that web-based management interfaces for your Zyxel APs are not exposed to untrusted or public networks. Implement strict access controls.
• Rotate Credentials: If there is any suspicion of credential exposure, rotate all privileged administrator passwords for your Zyxel devices.
• Implement Network Segmentation: Use network segmentation to limit management access to your APs to only trusted administrative networks.
• Review Logs: Regularly review device logs for any suspicious activity related to certificate exports or unusual command execution.
• Educate Developers: For developers, this incident underscores the critical importance of avoiding the construction of shell commands from user-controlled data. Always use non-shell execution interfaces with clearly separated arguments and robust input validation, rather than relying on quoting within dynamically assembled command strings.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.