Threat database

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device.

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026.

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026.

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.

CVE-2026-14818 is a path traversal vulnerability affecting multiple Zyxel firmware series, including ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN. The flaw exists in the CLI command that executes configuration files, allowing an authenticated administrator to execute crafted malicious configuration files. This vulnerability impacts firmware versions from V4.32 through V5.42 Patch 1 for ATP series, V4.50 through V5.42 Patch 1 for USG FLEX series, V4.16 through V5.42 Patch 1 for USG FLEX 50(W) series, and V4.16 through V5.42 Patch 1 for USG20(W)-VPN series. The CVSS 3.1 base score is 7.2, indicating a high severity. No patch or official remediation information is currently available.

CVE-2026-8508 is an improper authentication vulnerability in the Zyxel WAX650S firmware affecting versions up to 7.10(ABRM.4)C0. The flaw exists in the social_login.cgi CGI program and could allow an attacker connected to the WLAN to bypass captive portal authentication. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance has been provided by Zyxel as of the publication date. There are no known exploits in the wild. The vulnerability impacts confidentiality but does not affect integrity or availability.

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

CVE-2026-6952 is a high-severity post-authentication OS command injection vulnerability in the Zyxel AX7501-B1 firmware. It affects the syslog component's LogServer field, allowing an authenticated administrator to execute arbitrary OS commands. The vulnerability exists in firmware versions up to 5.17(ABPC.7.2)C0. No official patch or remediation guidance has been provided yet.

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

CVE-2026-3871 is a buffer overflow vulnerability in the UPnP DeletePortMapping() command of Zyxel VMG4005-B50B firmware versions up to and including 5.13(ABRL.5.4)C0. This vulnerability can be exploited by an adjacent attacker to cause a temporary denial-of-service (DoS) condition affecting the UPnP functionality of the device. The issue stems from improper size checking during buffer copy operations.

A buffer overflow vulnerability exists in the UPnP AddPortMapping() command of Zyxel VMG4005-B50B firmware versions up to and including 5.13(ABRL.5.4)C0. This vulnerability can be exploited by an adjacent attacker to cause a temporary denial-of-service (DoS) condition affecting the UPnP functionality of the device. The vulnerability is classified as CWE-120, indicating a classic buffer overflow due to lack of input size checking.

A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.00(ACPT.2)C0,  GS1200-5HPv3 firmware versions through 1.00(ACPU.2)C0, GS1200-8HPv3 firmware versions through 1.00(ACPV.2)C0, and GS1200-10v3 firmware versions through 1.00(ACPW.2)C0 could allow a LAN-based, unauthenticated attacker to read the system configuration from a log file via a crafted HTTP request.

CVE-2026-7287 is a high-severity buffer overflow vulnerability in Zyxel NWA1100-N firmware version 1.00(AACE.1)C0. It affects multiple functions within the device's 'webs' binary, allowing an attacker to cause a denial-of-service (DoS) by sending crafted HTTP requests. The vulnerability does not impact confidentiality or integrity but can disrupt availability by crashing the device. No official patch or remediation guidance is currently available from Zyxel. There are no known exploits in the wild at this time.

CVE-2026-7257 is a medium severity vulnerability in Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. It involves insecure storage of sensitive information in the device's configuration file. A local attacker with administrator privileges could download and decrypt a backup configuration file, potentially exposing sensitive data. There is no official patch or remediation level provided by the vendor at this time. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

CVE-2026-7256 is a high-severity OS command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. An adjacent attacker on the LAN can exploit this by sending a crafted HTTP request to execute arbitrary OS commands on the device. The vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78). No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-7255 is a medium severity vulnerability in Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. It involves improper restriction of excessive authentication attempts in the device's web management interface, allowing an adjacent attacker on the LAN to brute-force the password and bypass authentication. The vulnerability has a CVSS score of 6.5, indicating a moderate risk. No patch or official remediation has been confirmed by the vendor at this time. There are no known exploits in the wild.

CVE-2026-1460 is a high-severity post-authentication OS command injection vulnerability in Zyxel DX3301-T0 and EX3301-T0 firmware versions up to 5.50(ABVY.7.1)C0. It arises from improper neutralization of special elements in the DomainName parameter of the DHCP configuration file, allowing an authenticated administrator to execute arbitrary OS commands on the device. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-0711 is a post-authentication OS command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions up to 5.50(ABVY.7.1)C0. An attacker with administrator privileges and adjacent network access could exploit this flaw to execute arbitrary OS commands on the affected device. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. There is no official patch or remediation guidance currently available from Zyxel. No known exploits are reported in the wild at this time.