CVE-2026-6837

HIGH

MEDIUM Priority: 0.11 BB Relevance: 60/100

Published: 2026-08-04 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: High

UI: None

S: Unchanged

C: High

I: High

A: High

Description

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

Weakness Classification (1)

CWE-78

References & Advisories (1)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026

Bug Bounty Relevance

60 / 100

✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

1.52%

Raw Score 0.015210

Percentile 74.5%

Date 2026-10-29

EPSS Trend

2026-10-29

0.01521

2026-10-28

0.01521

Intelligence Sources

nvd ref →

External Links

NVD (NIST) CVE Details FIRST EPSS API OSV.dev