EUVD-2026-55621
GHSA-pmfq-2qhc-4w43
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adopting TR-CERT's network/low-complexity/no-auth vector for full-impact command injection, though PR:N is unverified since the injection endpoint is undisclosed and router injection often needs auth.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection.
This issue affects WAH7601: through 20072026.
AnalysisAI
OS command injection in the Zyxel WAH7601 4G/LTE CPE router lets an attacker inject arbitrary operating-system commands through improperly neutralized input, affecting all firmware builds up to and including version 20072026. Successful exploitation yields full command execution on the device with high confidentiality, integrity, and availability impact, per the TR-CERT-assigned CVSS 9.8 rating. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, so risk is currently theoretical-but-severe rather than confirmed active exploitation.
Technical ContextAI
The WAH7601 is a Zyxel customer-premises 4G/LTE router/gateway, a class of embedded Linux appliance that typically exposes a web administration interface and network services. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-supplied input is passed into a shell command context without sanitizing metacharacters such as ;, |, &, `, or $(), allowing an attacker to append or substitute their own commands. On embedded router firmware these injected commands commonly execute as root or an equally privileged service account, meaning a single injection point translates directly into full device control. The only CPE provided, cpe:2.3:a:zyxel_networks:wah7601:*:*:*:*:*:*:*:*, confirms the WAH7601 as the sole affected product with no version pinned in the CPE (the version bound comes from the description: through build 20072026).
RemediationAI
No vendor-released patch version is identified in the available data - the description bounds the vulnerability at firmware build 20072026, implying a later build resolves it, but the exact fixed version is not confirmed here, so verify against Zyxel's official advisory and the TR-CERT bulletin (TR-26-0799, https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0799) and apply the newest available WAH7601 firmware once published. Until a confirmed fixed build is applied, reduce exposure with concrete compensating controls: remove the device's web/management interface from any WAN/internet-facing binding and restrict it to a trusted management VLAN or source-IP allowlist (trade-off: remote administration becomes harder); disable remote management (HTTP/HTTPS/Telnet/SSH) over the WAN entirely if the feature is not required; place the router behind an upstream firewall that blocks inbound access to its admin ports (trade-off: does not protect against a malicious device on the LAN side); and change any default administrative credentials to blunt the authenticated-injection scenario. Monitor the device for unexpected outbound connections or configuration changes as a detective control.
Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the
Sensitive system information exposure in the Zyxel WAH7601 portable 4G LTE mobile hotspot allows unauthenticated adjacen
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today