What is the CVSS score of CVE-2026-7287?

CVE-2026-7287 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Zyxel NWA1100-N are affected by CVE-2026-7287?

CVE-2026-7287 affects Zyxel NWA1100-N access points, allowing unauthenticated remote attackers to crash devices through malformed HTTP requests, causing denial-of-service that could disrupt network…

How to fix or mitigate CVE-2026-7287?

24 hours: Identify all NWA1100-N devices running firmware 1.00(AACE.1)C0 in your environment through network scanning and asset inventory. 7 days: Isolate affected devices to restricted network segments or disable HTTP access via firewall rules; document business justification for any retained devices. 30 days: Develop replacement plan for end-of-life NWA1100-N units and migrate to supported Zyxel access point models with current security updates.

Zyxel NWA1100-N CVE-2026-7287

EUVD-2026-29378 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-12 Zyxel

GHSA-j38v-jpjg-hvr2

Zyxel Buffer Overflow

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 04:31 vuln.today

CVE Published

May 12, 2026 - 03:56 nvd

HIGH 7.5

DescriptionCVE.org

UNSUPPORTED WHEN ASSIGNED A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.

AnalysisAI

Remote unauthenticated attackers can crash Zyxel NWA1100-N access points running customized firmware version 1.00(AACE.1)C0 by sending malformed HTTP requests that trigger buffer overflows in five distinct web server functions (formWep, formWlAc, formPasswordSetup, formUpgradeCert, formDelcert). The vulnerability enables denial-of-service attacks with high CVSS 7.5 severity but is limited to an end-of-life product according to Zyxel's reference documentation. No public exploit code identified at time of analysis, and EPSS data is unavailable for this recent CVE.

Technical ContextAI

The vulnerability resides in the 'webs' binary, Zyxel's custom web server component that handles administrative HTTP requests on the NWA1100-N wireless access point. CWE-120 (Buffer Copy without Checking Size of Input) indicates classic memory safety failures where user-supplied HTTP parameters are copied into fixed-size stack or heap buffers without proper bounds checking. All five affected functions (formWep for WEP configuration, formWlAc for wireless access control, formPasswordSetup for credential management, formUpgradeCert and formDelcert for certificate operations) share this unsafe input handling pattern. The CPE identifier cpe:2.3:a:zyxel:nwa1100-n_firmware:*:*:*:*:*:*:*:* confirms this affects the firmware application layer rather than underlying Linux components. Buffer overflows in embedded device web servers are particularly concerning because these systems often lack modern exploit mitigations like ASLR or stack canaries, though in this case the impact is limited to availability disruption.

RemediationAI

No vendor-released patch identified at time of analysis - the affected Zyxel NWA1100-N product is end-of-life per https://www.zyxel.com/global/en/support/end-of-life, meaning Zyxel will not provide security updates. Organizations still deploying this hardware should replace it with currently supported access point models from Zyxel's active product line. As interim mitigation, restrict administrative HTTP/HTTPS access to the NWA1100-N web interface using network segmentation and firewall rules, allowing connections only from trusted management VLANs or specific administrator IP addresses. Disable remote management features if not operationally required and access the device only via out-of-band management networks. These compensating controls reduce attack surface but do not eliminate risk - note that blocking external access may conflict with legitimate remote administration requirements and requires careful network architecture planning. Monitor devices for unexpected reboots that could indicate exploitation attempts.