What is the CVSS score of CVE-2026-7256?

CVE-2026-7256 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Zyxel WRE6505 v2 are affected by CVE-2026-7256?

Zyxel WRE6505 v2 wireless extenders running firmware V1.00(ABDV.3)C0 contain an unauthenticated command injection vulnerability allowing any device on the local network to execute arbitrary commands…

How to fix or mitigate CVE-2026-7256?

Within 24 hours: Inventory all WRE6505 v2 devices in your environment and identify their network locations. Within 7 days: Implement network segmentation to isolate WRE6505 v2 devices on a separate VLAN with restricted access to critical resources, or disconnect units pending replacement. Within 30 days: Replace all WRE6505 v2 units with supported wireless extender models from the current Zyxel lineup and retire end-of-life equipment from production networks.

Zyxel WRE6505 v2 CVE-2026-7256

EUVD-2026-29376 HIGH

OS Command Injection (CWE-78)

2026-05-12 Zyxel

GHSA-c7j6-24cr-x2rf

Zyxel Command Injection

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 04:30 vuln.today

CVE Published

May 12, 2026 - 03:25 nvd

HIGH 8.8

DescriptionCVE.org

UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.

AnalysisAI

Command injection in Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0 allows unauthenticated adjacent network attackers to execute arbitrary operating system commands via crafted HTTP requests to the CGI interface. This vulnerability affects an end-of-life product with no vendor support, meaning no security patches will be released. Exploitation requires adjacent network access (same LAN segment) but no authentication, making it exploitable by any device on the local network including compromised IoT devices or malicious insiders.

Technical ContextAI

This is a classic command injection vulnerability (CWE-78) in the Common Gateway Interface (CGI) program of the WRE6505 v2 wireless range extender. CGI programs process web-based requests and often invoke shell commands to perform administrative functions. The vulnerability occurs when user-supplied input from HTTP requests is insufficiently validated before being passed to system command execution functions (such as system(), popen(), or exec() in C). According to the CPE string, this affects the WRE6505 v2 firmware platform specifically. The CVSS vector AV:A indicates adjacent network attack vector, meaning the attacker must be on the same network segment (Layer 2 broadcast domain) as the device, which is typical for LAN-side management interfaces on consumer networking equipment.

RemediationAI

No vendor-released patch will be made available as Zyxel has end-of-life'd the WRE6505 v2 product line per https://www.zyxel.com/global/en/support/end-of-life. Organizations must implement hardware replacement as the primary remediation strategy by migrating to currently supported Zyxel range extender models or alternative vendors with active security support. As interim compensating controls until replacement, isolate affected devices on dedicated VLAN segments with strict access control lists preventing access from untrusted LAN clients, disable the web management interface if CLI or alternative management methods are available (though this may impact usability), and implement network-based intrusion detection monitoring for HTTP POST requests to CGI endpoints with command injection patterns (semicolons, pipes, backticks in parameters). Note that disabling web management may render the device difficult to configure for non-technical users, and network segmentation only reduces exposure from compromised adjacent devices but does not eliminate risk from legitimate LAN users or physically proximate attackers. Hardware replacement remains the only complete mitigation for this permanently vulnerable EOL product.