Ax7501 B1 Firmware EUVD-2026-46145

Zyxel AX7501-B1 fiber ONT/CPE devices contain an OS command injection vulnerability (CVE-2026-6952, CVSS 7.2) allowing authenticated administrators to execute arbitrary commands on the device. Organizations relying on these devices for fiber connectivity face risk of full device compromise if administrative credentials are stolen or misused, potentially enabling lateral network access and service disruption.

Within 24 hours: Audit and document all AX7501-B1 devices running firmware 5.17(ABPC.7.2)C0 or earlier in your environment; immediately revoke or reset administrative credentials and restrict admin access to least-privilege service accounts only. Within 7 days: Implement network segmentation to isolate device management interfaces, enable command-line access logging and alerting on administrative logins, and monitor for suspicious syslog configuration changes. Within 30 days: Contact Zyxel to confirm firmware release timeline; evaluate replacement with alternate ONT/CPE models if no patch is available within your risk tolerance window, or implement compensating controls (see below) as interim measures pending vendor update.

No vendor-released patch identified at time of analysis. Interim mitigations: disable remote administrative access where operationally feasible; restrict device management to closed administrative networks or jump hosts with multi-factor authentication; configure network device monitoring to alert on unexpected syslog configuration modifications; implement read-only access for non-administrative monitoring; segment device management from production traffic; maintain audit logs of all administrative activities. These controls mitigate exposure but do not eliminate the vulnerability.