CVE-2026-6837: A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions

Description

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

Affected Products

Vendor	Product	Versions
zyxel	wax650s firmware	<= 7.10(ABRM.4)C0

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026(vendor-advisory)

Related News (4 articles)

Tier E

Reddit r/cybersecurity40d ago

CVE-2026-6837: Root Command Injection Affecting 18 Zyxel Access Point Models with full firmware emulation guide

→ No new info (linked only)

Tier E

Reddit r/netsec42d ago

CVE-2026-6837: Command Injection in Zyxel export-cgi PKCS#12 Export Handling

→ No new info (linked only)

Tier E

Reddit r/cybersecurity42d ago

CVE-2026-6837: Root Command Injection Affecting 18 Zyxel Access Point Models

→ No new info (linked only)

Tier C

VulDB

Discussion (0)

Loading…

CVSS 3.17.2 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026

CWECWE-78

PublishedAug 4, 2026

Trending Score1

Source articles4

Independent3

Info Completeness0/14

CVE-2026-6837: A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions

Description

Affected Products

References

Related News (4 articles)

Discussion (0)

Community Vote

Related CVEs (5)

Pin to Dashboard

Verification

Vulnerability Timeline