Zyxel WAX650S EUVD-2026-52567

The captive portal feature with social login must be enabled and actively in use on the WAX650S - this is a non-default configuration that requires administrative setup. The attacker must be physically within Wi-Fi range and able to associate with the target WLAN (i.e., the SSID must be open or the attacker must have the pre-shared key for a password-protected SSID using captive portal for secondary authentication). Exploitation is limited to the adjacent WLAN segment (AV:A) and cannot be triggered remotely over the internet. No authentication to the device or portal is required (PR:N). The attack is entirely passive from a user-interaction standpoint - no victim action is needed once the attacker is on the WLAN.

The CVSS 6.5 (Medium) score reflects real-world severity accurately: AV:A limits the blast radius to the local WLAN segment, ruling out remote internet-facing exploitation. AC:L and PR:N/UI:N indicate that once on the WLAN, bypassing the portal requires no special setup or victim interaction - this is a meaningful risk for any deployment using WAX650S for guest isolation. The C:H impact reflects that a successful bypass grants full network access behind the captive portal, potentially reaching internal VLANs, internet egress policies, or resources intended only for authenticated users. I:N and A:N indicate no direct write or denial-of-service capability from this bug alone. No EPSS data was provided; without KEV listing or published POC, exploitation probability is unconfirmed but the low complexity should be weighed against any real-world captive portal deployment. For organizations using WAX650S as a network boundary control (guest Wi-Fi, compliance-required access control), this should be treated as a high-priority operational risk despite its medium CVSS score, since captive portal bypass directly undermines the primary security control the device is providing.

An attacker associates with the WAX650S-hosted WLAN - for example, a guest network in a hotel or enterprise lobby - and, without entering valid credentials, crafts an HTTP request directly to the social_login.cgi endpoint that satisfies or skips its authentication validation. The captive portal marks the attacker's session as authenticated, granting full network access behind the portal. No public exploit code has been identified, but the AV:A/AC:L/PR:N characteristics indicate exploitation is mechanically straightforward for anyone who analyzes the CGI handler.