This vulnerability (CVE-2026-13206) in Zyxel Networks WAH7601 is caused by improper neutralization of special elements used in OS commands, classified as CWE-78 (OS command injection). It allows unauthenticated remote attackers to execute arbitrary OS commands on affected devices. The affected versions include all releases through 20072026. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary operating system commands on the affected Zyxel WAH7601 devices without authentication. This can lead to full compromise of the device, including unauthorized access, data disclosure, modification, and disruption of service. The critical CVSS score reflects the potential for severe impact on device security and network operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Zyxel Networks communications for updates. Applying network-level protections such as restricting access to the device management interface may reduce exposure but does not eliminate the vulnerability.