This vulnerability involves improper neutralization of special elements used in OS commands (CWE-78) within the LogServer field of the syslog component in Zyxel AX7501-B1 firmware. An attacker with administrator privileges who is authenticated on the device can exploit this flaw to execute arbitrary OS commands, potentially compromising confidentiality, integrity, and availability of the device. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected firmware versions include those through 5.17(ABPC.7.2)C0. No patch or official remediation level has been disclosed by Zyxel as of the publication date.

Successful exploitation allows an authenticated administrator to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the device, including unauthorized data access, modification, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to the syslog LogServer configuration. Avoid exposing the device management interfaces to untrusted networks.