Command Injection Vulnerability in Zyxel WAX650S Firmware
CVE-2026-6837

7.2HIGH

Key Information:

Vendor

Zyxel
Status
Wax650s Firmware
Vendor
CVE Published:
4 August 2026

What is CVE-2026-6837?

A post-authentication command injection vulnerability exists in the 'export-cgi' CGI program of Zyxel WAX650S firmware, allowing authenticated users with administrator privileges to execute arbitrary operating system commands on the device. This vulnerability poses significant risks as it could be exploited to manipulate device functionality and gain unauthorized access to sensitive system information.

Affected Version(s)

WAX650S firmware <= 7.10(ABRM.4)C0

References

https://www.zyxel.com/global/en/support/security-advisori...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.