THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

VERIFIEDBy Xavier Rivera· ·1 min read

Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

Zyxel disclosed CVE-2026-6837, a command injection vulnerability in the export-cgi program of WAX650S firmware through version 7.10(ABRM.4)C0 that lets authenticated administrators execute OS commands. The flaw scores 7.2 on CVSS v3.1 and was published August 3, 2026.

Source:NVD

Post

Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

TL;DRAI · 60 sec read

Zyxel has disclosed a high-severity post-authentication command injection vulnerability in its WAX650S wireless access point firmware.

The vulnerability carries a CVSS score of 7.2. CVE-2026-6837 affects the "export-cgi" CGI program in firmware versions through 7.10(ABRM.4)C0. An authenticated attacker with administrator privileges could exploit it to execute arbitrary OS commands on the device.

An authenticated attacker with administrator privileges could exploit it to execute arbitrary OS commands on the device.

The flaw was published to the CVE List on August 3, 2026 and added to the NVD dataset the following day.

Zyxel contributed the CVSS v3.1 assessment. The vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This indicates network attack vector, low attack complexity, high privileges required, no user interaction, and high impacts on confidentiality, integrity and availability.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

The weakness is tracked as CWE-78, improper neutralization of special elements used in an OS command.

Affected products are limited to one firmware branch.

Affected products are limited to one firmware branch. The vulnerability impacts Zyxel WAX650S firmware versions up to and including 7.10(ABRM.4)C0. Devices running later versions are listed as unaffected in the record.

Zyxel published a security advisory on August 4, 2026 that covers this command injection issue along with an improper authentication vulnerability in certain access points, firewalls and security routers. The advisory is available at the company's global support site.

The CVE record was received from Zyxel Corporation. No exploit details or proof-of-concept code appear in the NVD entry.

EXPERT TAKE

Enterprise teams running Zyxel WAX650S should treat this as an immediate patching priority given the high impact on device integrity once admin credentials are obtained.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

vulnerability security zyxel firmware

MORE IN TECH

Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8

Microsoft disclosed CVE-2026-62870, a use-after-free vulnerability in Excel rated CVSS 8.8 that allows remote code execution over a network. The flaw affects multiple supported versions of Microsoft 365 Apps, Excel 2016, Office 2019, and LTSC editions and was published August 3, 2026.

Camera-Equipped AirPods Might Reach Market Earlier Than Planned

Bloomberg's Mark Gurman reports that a faster-moving B790 camera AirPods project could reach production before the end of the year and may launch as soon as next month, while the more advanced B798 effort has slipped from 2026 to 2027. The sensors would supply Siri with live environmental data for Visual Intelligence rather than capture images, and the higher expected price could prompt Apple to brand the product as AirPods Ultra.

NVD Adds Shell Injection Flaw in Wazuh GitHub Actions Workflows as CVE-2026-67308

NVD has published CVE-2026-67308 for a shell injection vulnerability in Wazuh workflows before 44bf114. Attackers can reportedly execute arbitrary commands and exfiltrate GITHUB_TOKEN plus AWS credentials on self-hosted runners by submitting pull requests with crafted VERSION.json files. The record, received from VulnCheck on August 1 2026, carries a CVSS 3.1 score of 10.0 critical from the CNA.