Zyxel has released critical firmware updates addressing a severe command injection vulnerability (CVE-2026-6837) that affects 18 models of its wireless access points. The flaw, residing in the export functionality of the device’s certificate workflow, enables a user with admin credentials to run arbitrary operating system commands—potentially as root—if exploited.
What’s the risk?
The vulnerability lies in Zyxel’s export-cgi component, which handles certificate exports including password input parameters. Because the supplied password was embedded directly into a shell command without sufficient validation or escaping, an attacker could inject malicious shell syntax to alter or extend the command that gets executed. This is especially dangerous because the component runs in a highly privileged context, meaning successful exploitation could grant root-level access to the device’s operating system. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
An attacker would need more than just network access, however. Admin-level authentication is required before any injection can occur. But that doesn’t render the flaw harmless—compromised credentials, exposed management panels, or malicious insiders could all gain enough foothold to trigger this vulnerability. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
Which devices are affected — and what’s the patch?
The list of impacted models is extensive: it includes the NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E devices. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
Zyxel’s advisory (published August 4, 2026) confirms firmware version 7.12 as the fix line for all affected models. For example, WAX650S devices should be updated to version 7.12(ABRM.0)C0. Users of any listed model are strongly urged to apply the update immediately. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
Mitigation isn’t just patching. Organizations are advised to block or restrict web-based management access—especially from untrusted networks—to prevent exposure. Where possible, limit admin account exposure, rotate credentials if there are signs of compromise, segment devices within the network, and monitor logs for irregular certificate export or command execution behavior. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
Technical deep dive
Researcher Mina Nageh Salama dissected the issue using a fully emulated environment. The analysis involved extracting the WAX650S firmware (version 7.10(ABRM.4)C0), employing tools like QEMU, Bubblewrap, and reconstructed CGI handlers to reproduce the vulnerability in software. The proof of concept showed how HTTP responses could include the output of command injections via the export-certificate path. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
The problem is classified under CWE-78: improper neutralization of special elements in OS commands. The vulnerability is post-authentication, meaning the attacker must already hold admin access. Even so, because the issue arises from how user-supplied input gets concatenated into shell commands, it’s an example of avoidable risk: developers should use safe interfaces or split user data from command arguments rather than embedding raw input into dynamic command strings. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
For admins, the key takeaway is to update firmware, limit access, and verify that management interfaces aren’t exposed to the public internet. Logs should be scrutinized for anomalous certificate-export activity as someone attempting to leverage this vulnerability may leave traces before full compromise. ([cybersecuritynews.com](https://cybersecuritynews.com/zyxel-patches-command-injection-flaw/))
What this means going forward is clear: the flaw exposes inherent danger when device firmware handles user-controlled inputs insecurely—especially at high privilege levels. As enterprise and SMB infrastructures rely heavily on connected access points, bad actors can get deep traction once administrative control is gained. Vigilance in firmware hygiene, credential management, and network segmentation become not just best practices, but fundamental properties of resilient deployments.
