Zyxel NWA110AX CVE-2026-76955

The attacker must have adjacent-network (LAN) reachability to the vulnerable access point and be able to send input to the zdp_wtp binary (Zyxel's WTP/discovery-protocol component); the CVSS vector AV:A/PR:N/UI:N indicates no authentication and no user interaction are required once on the local network. The affected scope is Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0. The primary limiting factor is the adjacent-network requirement - the flaw is not exploitable directly from the internet and depends on the attacker having access to the same local segment as the device's management/service interface (e.g. an untrusted or guest LAN). The precise trigger within zdp_wtp is not described in the available sources.

This is a credible near-term priority rather than a theoretical high-CVSS issue, but its reach is bounded by the network vector. The CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes an adjacent-network, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact - consistent with the description's 'LAN-based attacker' and privilege escalation outcome, so the mechanism signals and the severity signals agree. The vuln.today decision label is 'this_week', indicating it should be remediated promptly but is not flagged emergency/act_now. Key exploitation signals are MISSING: no EPSS probability is supplied, the vulnerability is NOT listed in CISA KEV, and no proof-of-concept or exploit reference is present (only a vendor advisory). Because exploitation requires adjacent/LAN access rather than internet-facing reachability, real-world risk is elevated for environments where an attacker can already reach the AP's local segment (e.g. guest/office Wi-Fi) but lower for devices isolated from untrusted LAN clients. Treat as a prompt-patch item driven by the vendor-confirmed severity, not by any observed exploitation.

An attacker who has gained a foothold on the same local network as a vulnerable Zyxel NWA110AX access point (for example via a compromised or guest Wi-Fi client) sends crafted traffic to the zdp_wtp service, overflowing a buffer to corrupt memory. Because the flaw requires no authentication and low attack complexity over the adjacent network, successful exploitation escalates the attacker's privileges on the device, yielding full control of the AP. No public exploit identified at time of analysis.