THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

VERIFIEDBy Xavier Rivera· ·1 min read

Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

Zyxel disclosed CVE-2026-6837, a command injection vulnerability in the export-cgi program of WAX650S firmware through version 7.10(ABRM.4)C0 that lets authenticated administrators execute OS commands. The flaw scores 7.2 on CVSS v3.1 and was published August 3, 2026.

Source:NVD

Post

Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

TL;DRAI · 60 sec read

Zyxel has disclosed a high-severity post-authentication command injection vulnerability in its WAX650S wireless access point firmware.

The vulnerability carries a CVSS score of 7.2. CVE-2026-6837 affects the "export-cgi" CGI program in firmware versions through 7.10(ABRM.4)C0. An authenticated attacker with administrator privileges could exploit it to execute arbitrary OS commands on the device.

An authenticated attacker with administrator privileges could exploit it to execute arbitrary OS commands on the device.

The flaw was published to the CVE List on August 3, 2026 and added to the NVD dataset the following day.

Zyxel contributed the CVSS v3.1 assessment. The vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This indicates network attack vector, low attack complexity, high privileges required, no user interaction, and high impacts on confidentiality, integrity and availability.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

The weakness is tracked as CWE-78, improper neutralization of special elements used in an OS command.

Affected products are limited to one firmware branch.

Affected products are limited to one firmware branch. The vulnerability impacts Zyxel WAX650S firmware versions up to and including 7.10(ABRM.4)C0. Devices running later versions are listed as unaffected in the record.

Zyxel published a security advisory on August 4, 2026 that covers this command injection issue along with an improper authentication vulnerability in certain access points, firewalls and security routers. The advisory is available at the company's global support site.

The CVE record was received from Zyxel Corporation. No exploit details or proof-of-concept code appear in the NVD entry.

EXPERT TAKE

Enterprise teams running Zyxel WAX650S should treat this as an immediate patching priority given the high impact on device integrity once admin credentials are obtained.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

vulnerability security zyxel firmware

MORE IN TECH

iOS 27 Beta 5 Released as iPhone 18 Pro Details Surface

The fifth beta of iOS 27 arrived this week alongside an alleged iPhone 18 Pro Max battery leak showing 5,391 mAh capacity, screen protector images confirming asymmetric corners on the foldable iPhone Ultra, and Mark Gurman's report on radical Apple Watch redesigns that may include round faces and screenless trackers.

ShinyHunters Extortion Gang Leaks Data from 1.6 Million RingCentral Accounts

ShinyHunters obtained and later leaked personal data belonging to 1.6 million RingCentral accounts after a July breach. The incident touched only a limited portion of the cloud communications provider’s customers and left core services untouched.

SpaceX completes $60 billion purchase of AI coding firm Cursor

SpaceX has completed its $60 billion acquisition of AI coding startup Cursor, granting the company access to the world's largest GPU fleet for lower-cost model development. The deal, which began with an April partnership and follows SpaceX's merger with xAI, has already produced Grok 4.5 and 4.6 focused on coding and real-world tasks.