Zyxel WAX650S CVE-2026-6837

Exploitation requires an active authenticated session with administrator-level privileges on the WAX650S management interface - confirmed by CVSS PR:H. The attack is delivered over the network to the device's web management interface (CVSS AV:N), requiring no user interaction beyond the attacker's own actions (UI:N). No special non-default configuration of the device is required; the "export-cgi" CGI program is part of the standard firmware. Exploitation is strictly limited by the administrator credential prerequisite: unauthenticated remote exploitation is not possible. Additionally, only firmware versions at or below 7.10(ABRM.4)C0 are confirmed vulnerable - devices running a patched firmware version are not affected.

The CVSS 3.1 base score of 7.2 reflects a high-impact but access-constrained vulnerability: AV:N/AC:L confirm the management interface is network-reachable with no complexity barrier, but PR:H is the critical limiting factor - administrator credentials must already be in the attacker's possession. Full CIA impact (C:H/I:H/A:H) indicates complete device compromise once exploitation succeeds. No EPSS data was provided in the input, precluding probabilistic exploitation likelihood comparison. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. The vendor self-reported this flaw, which suggests responsible internal discovery rather than active exploitation in the wild. Real-world risk is moderate-to-low in most environments: the administrator privilege requirement means attackers must first obtain credentials via phishing, credential stuffing, or lateral movement - making this a post-breach amplifier rather than an initial access vector. Organizations with weak or shared admin passwords on network appliances should treat this with higher urgency.

An attacker who has obtained WAX650S administrator credentials - through password reuse, phishing of a network admin, or lateral movement from a compromised management workstation - authenticates to the device's web interface and sends a crafted HTTP request to the "export-cgi" endpoint containing shell metacharacters (e.g., semicolons, backticks, or pipe characters) embedded in an unsanitized parameter. The firmware passes this input unsanitized to an OS shell call, executing the injected commands with system-level privileges, potentially enabling persistent backdoor installation, credential harvesting, or use of the access point as a network pivot. No public exploit code has been identified at time of analysis.