What is the CVSS score of CVE-2026-6837?

CVE-2026-6837 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Zyxel WAX650S are affected by CVE-2026-6837?

Zyxel WAX650S Wi-Fi 6 access points running firmware through version 7.10(ABRM.4)C0 contain a command injection vulnerability in the export-cgi program that enables authenticated administrators to…

How to fix or mitigate CVE-2026-6837?

Within 24 hours: inventory all deployed Zyxel WAX650S access points and document current firmware versions to identify affected devices. Within 7 days: restrict administrator account credentials through enforcement of complex passwords, disable remote administration capabilities unless operationally critical, implement multi-factor authentication for administrative access if device firmware supports it, and review access logs for unauthorized or suspicious administrator activity. Within 30 days: monitor Zyxel security advisories and vendor website for patch releases; establish a testing and deployment process to apply firmware updates immediately upon vendor release.

Zyxel WAX650S CVE-2026-6837

EUVD-2026-52566 HIGH

OS Command Injection (CWE-78)

2026-08-04 Zyxel

GHSA-fq66-x242-gfpv

Zyxel Command Injection Wax650S Firmware

7.2

CVSS 3.1 · Vendor: Zyxel

Severity by source

Vendor (Zyxel) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Management interface is network-reachable (AV:N); administrator credentials required (PR:H); no complexity beyond auth; full device CIA compromise with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zyxel).

CVSS VectorVendor: Zyxel

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 02:43 vuln.today

CVE Published

Aug 04, 2026 - 01:52 cve.org

HIGH 7.2

DescriptionCVE.org

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

AnalysisAI

Command injection in the Zyxel WAX650S Wi-Fi 6 access point firmware enables an authenticated administrator to execute arbitrary OS commands via the "export-cgi" CGI program. All firmware versions through 7.10(ABRM.4)C0 are affected, with full confidentiality, integrity, and availability impact on the device. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain WAX650S administrator credentials

Delivery

Authenticate to network-accessible management interface

Exploit

Send crafted request to export-cgi with injected shell metacharacters

Execution

Firmware passes unsanitized input to OS shell

Persist

Execute arbitrary commands with system-level privileges

Impact

Full device compromise

Access

Obtain WAX650S administrator credentials

Delivery

Authenticate to network-accessible management interface

Exploit

Send crafted request to export-cgi with injected shell metacharacters

Execution

Firmware passes unsanitized input to OS shell

Persist

Execute arbitrary commands with system-level privileges

Impact

Full device compromise

Vulnerability AssessmentAI

Exploitation	Exploitation requires an active authenticated session with administrator-level privileges on the WAX650S management interface - confirmed by CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.2 reflects a high-impact but access-constrained vulnerability: AV:N/AC:L confirm the management interface is network-reachable with no complexity barrier, but PR:H is the critical limiting factor - administrator credentials must already be in the attacker's possession. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has obtained WAX650S administrator credentials - through password reuse, phishing of a network admin, or lateral movement from a compromised management workstation - authenticates to the device's web interface and sends a crafted HTTP request to the "export-cgi" endpoint containing shell metacharacters (e.g., semicolons, backticks, or pipe characters) embedded in an unsanitized parameter. The firmware passes this input unsanitized to an OS shell call, executing the injected commands with system-level privileges, potentially enabling persistent backdoor installation, credential harvesting, or use of the access point as a network pivot. …
Remediation	Apply the firmware update published by Zyxel in their security advisory at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026; the exact target firmware version is not specified in the available input data and must be confirmed directly from the advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report.