What is the CVSS score of CVE-2026-6952?

CVE-2026-6952 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Ax7501 B1 Firmware are affected by CVE-2026-6952?

Zyxel AX7501-B1 fiber ONT/CPE devices contain an OS command injection vulnerability (CVE-2026-6952, CVSS 7.2) allowing authenticated administrators to execute arbitrary commands on the device.

How to fix or mitigate CVE-2026-6952?

Within 24 hours: Audit and document all AX7501-B1 devices running firmware 5.17(ABPC.7.2)C0 or earlier in your environment; immediately revoke or reset administrative credentials and restrict admin access to least-privilege service accounts only. Within 7 days: Implement network segmentation to isolate device management interfaces, enable command-line access logging and alerting on administrative logins, and monitor for suspicious syslog configuration changes. Within 30 days: Contact Zyxel to confirm firmware release timeline; evaluate replacement with alternate ONT/CPE models if no patch is available within your risk tolerance window, or implement compensating controls (see below) as interim measures pending vendor update.

Ax7501 B1 Firmware CVE-2026-6952

EUVD-2026-46145 HIGH

OS Command Injection (CWE-78)

2026-07-21 Zyxel

GHSA-957w-jr89-h22x

Command Injection Zyxel Ax7501 B1 Firmware

7.2

CVSS 3.1 · Vendor: Zyxel

Severity by source

Vendor (Zyxel) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Zyxel) · only source for this CVE.

CVSS VectorVendor: Zyxel

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 02:45 vuln.today

CVE Published

Jul 21, 2026 - 02:00 cve.org

HIGH 7.2

DescriptionCVE.org

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

AnalysisAI

OS command injection in the Zyxel AX7501-B1 fiber ONT/CPE allows an authenticated administrator to run arbitrary operating-system commands by injecting shell metacharacters into the "LogServer" field of the device's syslog configuration. All firmware up to and including 5.17(ABPC.7.2)C0 is affected, and successful exploitation yields full command execution on the device (CVSS 7.2, PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.