Zyxel AP/Routers Command Injection and Auth Bypass Vulnerabilities (CVE-2026-6837/8508)

Vulnerability Overview Zyxel has issued a security advisory indicating that certain access points (APs), the FWA7, and security routers contain command injection and improper authentication vulnerabilities. The specific vulnerabilities are as follows: CVE-2026-6837: A post-authentication command injection vulnerability in the CGI program, allowing authenticated attackers to execute OS commands on affected devices. CVE-2026-8508: A post-authentication improper authentication vulnerability in the CGI program, allowing attackers to bypass captive portal authentication on WLANs. Affected Scope Models and Versions Affected by CVE-2026-6837 APs - NWA50AX: 7.10\ - NWA50AX PRO: 7.10\ - NWA55AXE: 7.10\ - NWA55AX PRO: 7.10\ - NWA55AX PTP: 7.10\ - NWA90AX: 7.10\ - NWA90AX PRO: 7.10\ - NWA110AX: 7.10\ - NWA210AX: 7.10\ - NWA220AX-6E: 7.10\ - WAX300H: 7.10\ - WAX510D: 7.10\ - WAX610D: 7.10\ - WAX620D-6E: 7.10\ - WAX630S: 7.10\ - WAX640S-6E: 7.10\ - WAX650S: 7.10\ - WAX655E: 7.10\ Models and Versions Affected by CVE-2026-8508 APs - IAP500BE: 7.30\ - NWA30BE: 7.30\ - NWA50AX: 7.10\ - NWA50AX PRO: 7.10\ - NWA50BE: 7.30\ - NWA50BE PRO: 7.30\ - NWA55AXE: 7.10\ - NWA55AX PRO: 7.10\ - NWA55AX PTP: 7.10\ - NWA55BE: 7.30\ - NWA90AX: 7.10\ - NWA90AX PRO: 7.10\ - NWA90BE: 7.30\ - NWA90BE PRO: 7.30\ - NWA110AX: 7.10\ - NWA110BE: 7.30\ - NWA130BE: 7.30\ - NWA210AX: 7.10\ - NWA210AXv2: 7.30\ - NWA210BE: 7.30\ - NWA220AX-6E: 7.10\ - NWA240BE: 7.30\ - WAC500H: 6.70\ - WAX300H: 7.10\ - WAX510D: 7.10\ - WAX610D: 7.10\ - WAX620D-6E: 7.10\ - WAX630S: 7.10\ - WAX640S-6E: 7.10\ - WAX650S: 7.10\ - WAX655E: 7.10\ - WBE530: 7.35\ - WBE510D: 7.30\ - WBE630S: 7.30\ - WBE660S: 7.30\ - WBE665S: 7.35\ FWA7 - FWA7 Leaf Plus: 7.35\ - FWA7 Root Plus: 7.35\ Security Routers - USG LITE 60AX: 2.30\ Mitigation For CVE-2026-6837, users are advised to install the latest firmware version to patch the vulnerability. For CVE-2026-8508, users are advised to install the latest firmware version to patch the vulnerability. The specific patched versions are as follows: - NWA50AX: 7.12\ - NWA50AX PRO: 7.12\ - NWA55AXE: 7.12\ - NWA55AX PRO: 7.12\ - NWA55AX PTP: 7.12\ - NWA90AX: 7.12\ - NWA90AX PRO: 7.12\ - NWA110AX: 7.12\ - NWA210AX: 7.12\ - NWA220AX-6E: 7.12\ - WAX300H: 7.12\ - WAX510D: 7.12\ - WAX610D: 7.12\ - WAX620D-6E: 7.12\ - WAX630S: 7.12\ - WAX640S-6E: 7.12\ - WAX650S: 7.12\ - WAX655E: 7.12\ - IAP500BE: 7.40\ - NWA30BE: 7.40\ - NWA50AX: 7.12\ - NWA50AX PRO: 7.12\ - NWA50BE: 7.40\ - NWA50BE PRO: 7.40\ - NWA55AXE: 7.12\ - NWA55AX PRO: 7.12\ - NWA55AX PTP: 7.12\ - NWA55BE: 7.40\ - NWA90AX: 7.12\ - NWA90AX PRO: 7.12\ - NWA90BE: 7.40\ - NWA90BE PRO: 7.40\ - NWA110AX: 7.12\ - NWA110BE: 7.40\ - NWA130BE: 7.40\ - NWA210AX: 7.12\ - NWA210AXv2: 7.40\ - NWA210BE: 7.40\ - NWA220AX-6E: 7.12\ - NWA240BE: 7.40\ - WAC500H: Hotfix is available upon request - WAX300H: 7.12\ - WAX510D: 7.12\ - WAX610D: 7.12\ - WAX620D-6E: 7.12\ - WAX630S: 7.12\ - WAX640S-6E: 7.12\ - WAX650S: 7.12\ - WAX655E: 7.12\ - WBE530: 7.40\ - WBE510D: 7.40\ - WBE630S: 7.40\ - WBE660S: 7.40\ - WBE665S: 7.40\ - FWA7 Leaf Plus: 7.40\ - FWA7 Root Plus: 7.40\ - USG LITE 60AX: 2.40\ Please contact the local Zyxel support team for the file. Available via Cloud Update. Additional Information Acknowledgments: Thanks to Mina Nageh Salama for reporting this issue. Revision History: Initial release on 2026-8-4. Contact Information For any questions, please contact your local Zyxel service representative or visit the Zyxel Community for more information or assistance.

Goal Reached Thanks to every supporter — we hit 100%!

Zyxel AP/Routers Command Injection and Auth Bypass Vulnerabilities (CVE-2026-6837/8508)