Executive Summary
A post-authentication command injection vulnerability has been disclosed in the Zyxel WAX650S Wi-Fi 6 access point, tracked as CVE-2026-6837 with a CVSS 3.1 score of 7.2 (HIGH). An attacker with valid administrator credentials can inject and execute arbitrary OS commands through the export-cgi CGI program over the network.
No user interaction is required once authenticated. While the high privilege requirement limits the attack surface, the vulnerability poses meaningful risk in environments with shared, weak, or compromised administrator credentials.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-6837 |
| CVSS 3.1 Score | 7.2 (HIGH) |
| CVSS Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Type | Post-Auth OS Command Injection (CWE-78) |
| Attack Vector | Network |
| Authentication | Administrator credentials required |
| User Interaction | None |
| Active Exploitation | Not detected (not on CISA KEV) |
Vulnerability Details
Root Cause
CVE-2026-6837 is classified as CWE-78: Improper Neutralization of Special Elements Used in an OS Command. The export-cgi CGI program — used to export device configuration and diagnostic data — fails to properly sanitize user-supplied input before passing it to OS-level command execution. An attacker can inject shell metacharacters or command separators to escape the intended command context and execute arbitrary commands as the web server process.
Affected Component
The export-cgi program is a CGI handler on the WAX650S access point that handles configuration export and diagnostic data retrieval requests. Because the program is invoked via the management web interface, it is reachable from any host with access to the device's admin panel.
Affected Products
| Product | Affected Firmware | Status |
|---|---|---|
| Zyxel WAX650S | All versions through 7.10(ABRM.4)C0 | Patch pending — check Zyxel Security Advisories |
The NVD entry is currently in "Awaiting Enrichment" status, meaning the full patch version details from Zyxel had not yet been incorporated at time of publication. Monitor Zyxel Security Advisories for the fixed firmware version.
CVSS Breakdown
The 7.2 HIGH score reflects full confidentiality, integrity, and availability impact, despite the high privilege requirement:
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Exploitable over network |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | High | Administrator account needed |
| User Interaction | None | No victim interaction required |
| Scope | Unchanged | Impact contained to the device |
| Confidentiality | High | Full config and credential exposure possible |
| Integrity | High | Arbitrary command execution |
| Availability | High | Device can be disrupted or bricked |
Risk Assessment
Who Is at Risk
- Organizations using Zyxel WAX650S access points with internet-exposed management interfaces
- Environments with shared or default administrator passwords
- Networks where a threat actor has already obtained low-privileged credentials and attempts privilege escalation to the admin panel
Post-Exploitation Impact
Successful exploitation of this vulnerability on a managed access point could allow an attacker to:
- Extract device configurations, including Wi-Fi PSKs and VPN credentials
- Modify SSID configurations or introduce rogue access points
- Use the access point as a pivot point into the internal network
- Disrupt wireless connectivity via availability attacks
- Establish persistent backdoors on the device
Remediation
Immediate Actions
-
Apply Zyxel's firmware update as soon as it is published. Monitor Zyxel Security Advisories for the patched version announcement.
-
Restrict management interface access — Ensure the admin panel is not internet-exposed. Place it behind a VPN or dedicated management VLAN.
-
Rotate administrator credentials — Use strong, unique passwords. Disable default credentials if they haven't been changed.
-
Enable multi-factor authentication if supported by your Zyxel controller or cloud management platform.
-
Audit administrator accounts — Remove unused or unnecessary admin accounts to limit attack surface.
Network Controls
Recommended ACL for WAX650S management:
- Allow: Management VLAN / trusted admin subnet only
- Deny: All other sources to TCP/80, TCP/443 (management ports)
- Log: All denied connection attempts to management interfaceDetection
Since this is a post-authentication vulnerability, detection should focus on:
| Signal | Description |
|---|---|
| Unusual admin login times | Authentication outside business hours |
| Export-cgi requests with special characters | Shell metacharacters in CGI parameters |
| Unexpected outbound connections from AP | C2 communication post-exploitation |
| Configuration changes to SSIDs or VPN settings | Unauthorized modification |
| New/modified files on the device filesystem | Persistence mechanisms |
Key Takeaways
- CVSS 7.2 HIGH — Post-auth command injection with full C/I/A impact on the device
- No active exploitation detected — Not listed on CISA KEV as of August 4, 2026
- Limit admin interface exposure — Never expose access point management to the internet
- Patch when available — Monitor Zyxel advisories for the fixed firmware release
- Audit credentials — The high privilege requirement means credential hygiene directly reduces risk