← All Advisories

Zyxel WAH7601 Through July 2026 Firmware OS Command Injection Allows Attackers to Execute Arbitrary OS Commands on Affected Devices

Last refreshed2026-09-28

Status: NEW  |  Advisory ID: CVE-2026-13206

Key Details

CVECVE-2026-13206
CVSS Score / Version9.8 (Critical) / CVSS v3.1
Updated2026-08-26
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Classified asCWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

What to Know

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection.

This issue affects WAH7601: through 20072026. (NVD)

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-13206
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-13206