This vulnerability (CVE-2026-13206) in Zyxel Networks WAH7601 is caused by improper neutralization of special elements used in OS commands, leading to OS command injection. This allows unauthenticated remote attackers to execute arbitrary commands on the affected device. The issue affects all versions through 20072026. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation could allow remote attackers to execute arbitrary OS commands on the affected Zyxel WAH7601 device, potentially leading to full compromise of the device, including unauthorized access, data disclosure, and disruption of service. The critical CVSS score of 9.8 indicates a severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of affected devices and applying any recommended vendor mitigations once available.