Loading story…
Zyxel has disclosed and patched CVE-2026-6952, a post-authentication command injection flaw affecting certain DSL/Ethernet CPE devices, Fiber ONTs, and Wireless Extenders across multiple models and firmware versions. The vulnerability resides in the LogServer field of the syslog component and could let an authenticated attacker with administrator privileges execute operating system commands on an affected device.
The Canadian Centre for Cyber Security issued alert AV26-725 urging organizations, service providers, and users to review Zyxel’s advisory and apply the relevant firmware updates. Zyxel said WAN access is disabled by default and that exploitation requires valid or compromised user-configured credentials, and it published fixed firmware versions for affected products while crediting researcher William Honnér for reporting the issue.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published alert AV26-725 regarding Zyxel's advisory and urged users and administrators to review the vendor guidance and apply the necessary updates. The alert highlighted the post-authentication command injection issue affecting multiple Zyxel product lines.
Zyxel published a security advisory for CVE-2026-6952, a post-authentication command injection vulnerability in certain DSL/Ethernet CPE devices, fiber ONTs, and wireless extenders. The advisory said the flaw affects the "LogServer" field of the syslog component and provided fixed firmware versions for affected models.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcezyxel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zyxel has disclosed multiple security vulnerabilities affecting several of its firewall product lines, including the ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series. One of the critical vulnerabilities, tracked as CVE-2025-9133, is a missing authorization flaw present in ATP series firmware versions from V4.32 through V5.40, USG FLEX series from V4.50 through V5.40, USG FLEX 50(W) from V4.16 through V5.40, and USG20(W)-VPN from V4.16 through V5.40. This vulnerability allows a semi-authenticated attacker—someone who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device. The ability to access configuration files could expose sensitive information, including network settings and potentially credentials, increasing the risk of further compromise. The vulnerability is remotely exploitable, making it a significant concern for organizations using these devices in perimeter security roles. In addition to the missing authorization issue, Zyxel's advisory also addresses a post-authentication command injection vulnerability in the same product lines, further elevating the risk profile. The Canadian Centre for Cyber Security has issued an alert urging users and administrators to review Zyxel's advisories and apply the necessary firmware updates to mitigate these risks. The vulnerabilities impact a wide range of firmware versions, indicating that many deployed devices may be at risk if not promptly updated. Zyxel has published detailed advisories and provided links for users to access patches and further information. The vulnerabilities were disclosed on October 21, 2025, and organizations are advised to act quickly to prevent potential exploitation. The missing authorization flaw specifically highlights the importance of robust authentication and session management in security appliances. Attackers exploiting this flaw could bypass intended access controls, undermining the security posture of affected networks. The command injection vulnerability, while requiring authentication, could allow attackers to execute arbitrary commands on the device, potentially leading to full system compromise. Both vulnerabilities underscore the need for regular firmware updates and vigilant monitoring of security advisories from vendors. Organizations should also review their 2FA implementations and ensure that partial authentication does not grant unintended access. The advisories recommend immediate patching as the primary mitigation step. Security teams are encouraged to audit their Zyxel device inventories and verify that all affected models are updated to the latest secure firmware versions. Failure to address these vulnerabilities could result in unauthorized access, data leakage, or further exploitation by threat actors. The coordinated disclosure and response from Zyxel and cybersecurity authorities aim to minimize the window of exposure for customers worldwide.
Jul 12, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026
The Centre for Cybersecurity Belgium warned of a **critical OS command injection** vulnerability affecting **Zyxel EX3510-B0** routers’ UPnP functionality, tracked as **CVE-2025-13942** (CVSS 3.1 **9.8**, **CWE-78**). Successful exploitation could allow an unauthenticated remote attacker to execute OS commands by sending **specially crafted UPnP SOAP requests**, potentially leading to full device compromise. Zyxel published a security advisory covering this issue and recommended customers apply vendor updates; the Belgian advisory similarly urged **immediate patching** and increased monitoring, noting that updating does not remediate any **prior compromise**. Separately, Zyxel also disclosed a related but distinct command injection issue in a different model—**CVE-2025-13943** in **EX3301-T0**—which requires authentication and is triggered via the log file download function, and should be tracked and remediated as a separate vulnerability from the EX3510-B0 UPnP flaw.
Jun 29, 2026