Loading story…
Zyxel's WAH7601 portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw CVE-2026-13206 and the high-severity credential exposure issue CVE-2026-12984. According to TR-CERT advisory TR-26-0799, all four flaws affect firmware through build 20072026. The command injection bug is remotely exploitable and carries a CVSS 9.8 score, while the credential issue, scored CVSS 8.2, can allow unauthorized retrieval of embedded sensitive data.
The reported impact includes root-level remote code execution, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were unpatched at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-12984 was disclosed as a high-severity vulnerability in Zyxel WAH7601 devices through version 20072026 caused by insufficiently protected credentials. The flaw allows unauthorized retrieval of embedded sensitive data and has a CVSS 3.1 score of 8.2.
CVE-2026-13206 was disclosed as a critical remotely exploitable OS command injection flaw in Zyxel WAH7601 devices through version 20072026. The issue allows unauthenticated command execution and carries a CVSS 3.1 score of 9.8.
At the time of the report, Zyxel had not released a firmware update or patch for the four disclosed WAH7601 vulnerabilities. The report recommended restricting management access, removing internet exposure, or replacing the device if access could not be adequately controlled.
TR-CERT published advisory TR-26-0799 covering four vulnerabilities in Zyxel WAH7601 devices: CVE-2026-13206, CVE-2026-12984, CVE-2026-6374, and CVE-2026-6373. The advisory attributes discovery to Hasan Egemen Erbaş and states the issues affect firmware through build identifier 20072026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zyxel has disclosed and patched **CVE-2026-6952**, a post-authentication command injection flaw affecting certain **DSL/Ethernet CPE devices, Fiber ONTs, and Wireless Extenders** across multiple models and firmware versions. The vulnerability resides in the `LogServer` field of the syslog component and could let an authenticated attacker with administrator privileges execute operating system commands on an affected device. The Canadian Centre for Cyber Security issued alert **AV26-725** urging organizations, service providers, and users to review Zyxel’s advisory and apply the relevant firmware updates. Zyxel said WAN access is disabled by default and that exploitation requires valid or compromised user-configured credentials, and it published fixed firmware versions for affected products while crediting researcher **William Honnér** for reporting the issue.
Jul 21, 2026
The Centre for Cybersecurity Belgium warned of a **critical OS command injection** vulnerability affecting **Zyxel EX3510-B0** routers’ UPnP functionality, tracked as **CVE-2025-13942** (CVSS 3.1 **9.8**, **CWE-78**). Successful exploitation could allow an unauthenticated remote attacker to execute OS commands by sending **specially crafted UPnP SOAP requests**, potentially leading to full device compromise. Zyxel published a security advisory covering this issue and recommended customers apply vendor updates; the Belgian advisory similarly urged **immediate patching** and increased monitoring, noting that updating does not remediate any **prior compromise**. Separately, Zyxel also disclosed a related but distinct command injection issue in a different model—**CVE-2025-13943** in **EX3301-T0**—which requires authentication and is triggered via the log file download function, and should be tracked and remediated as a separate vulnerability from the EX3510-B0 UPnP flaw.
Jun 29, 2026
Three critical vulnerabilities, **CVE-2026-7121**, **CVE-2026-7122**, and **CVE-2026-7125**, were disclosed in the **Totolink A8000RU** router running firmware `7.1cu.643_b20200521`, all affecting the `/cgi-bin/cstecgi.cgi` CGI handler. The flaws are OS command injection issues in the `setWizardCfg`, `setUPnPCfg`, and `setWiFiEasyCfg` functions, where crafted input to the `wizard`, `enable`, and `merge` arguments can trigger command execution on the device. The vulnerabilities are mapped to **CWE-78** and **CWE-77** and were rated critical across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** scoring schemes. All three issues are remotely exploitable over the network and require **no privileges** and **no user interaction**, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.
Jun 29, 2026