Skip to main content

Zyxel WAX650S EUVDEUVD-2026-52567

| CVE-2026-8508 MEDIUM
Improper Authentication (CWE-287)
2026-08-04 Zyxel GHSA-hq2r-whw2-gr82
Zyxel Authentication Bypass Wax650S Firmware
6.5
CVSS 3.1 · Vendor: Zyxel
Share

Severity by source

Vendor (Zyxel) PRIMARY
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Adjacent network vector confirmed; PR:N as captive portal bypass requires no prior credentials; C:H reflects full post-portal network access; no integrity or availability impact from bypass alone.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Zyxel).

CVSS VectorVendor: Zyxel

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
Analysis Generated
Aug 04, 2026 - 02:43 vuln.today

DescriptionCVE.org

An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.

AnalysisAI

Captive portal authentication bypass in Zyxel WAX650S firmware exposes guest or restricted wireless networks to unauthorized access by any WLAN-adjacent attacker. The flaw resides in the social_login.cgi CGI handler, where CWE-287 (Improper Authentication) allows requests to circumvent captive portal enforcement entirely - not just weaken it. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Associate with target WLAN
Delivery
Identify social_login.cgi captive portal endpoint
Exploit
Send crafted unauthenticated request to CGI handler
Execution
Authentication check bypassed
Impact
Access network resources behind captive portal
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The captive portal feature with social login must be enabled and actively in use on the WAX650S - this is a non-default configuration that requires administrative setup. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.5 (Medium) score reflects real-world severity accurately: AV:A limits the blast radius to the local WLAN segment, ruling out remote internet-facing exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker associates with the WAX650S-hosted WLAN - for example, a guest network in a hotel or enterprise lobby - and, without entering valid credentials, crafts an HTTP request directly to the social_login.cgi endpoint that satisfies or skips its authentication validation. The captive portal marks the attacker's session as authenticated, granting full network access behind the portal. …
Remediation Consult the Zyxel security advisory at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026 and apply the firmware update that supersedes 7.10(ABRM.4)C0; a specific patched version number was not independently confirmed from the available input data - verify the exact target version from the advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wax650S Firmware

View all
CVE-2024-7261 CRITICAL
9.8 Sep 03

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware
CVE-2022-26532 HIGH
7.8 May 24

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 t
CVE-2022-26531 HIGH
7.8 May 24

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versio
CVE-2026-6837 HIGH
7.2 Aug 04

Command injection in the Zyxel WAX650S Wi-Fi 6 access point firmware enables an authenticated administrator to execute a
CVE-2024-1575 MEDIUM
6.5 Jul 23

The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions

CVE-2023-22918 MEDIUM
6.5 Apr 24

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 t
CVE-2023-5797 MEDIUM
5.5 Nov 28

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 t
CVE-2023-37925 MEDIUM
5.5 Nov 28

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 t
CVE-2024-12398 HIGH
8.8 Jan 14

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions thr

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-52567 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy