OS Command Injection in Zyxel WAH7601 Web Management Interface

Successful exploitation can result in full compromise of the affected router. Because commands are executed as root, an attacker can take complete administrative control of the device, alter configuration, access sensitive stored credentials, intercept or redirect network traffic, establish persistence, and potentially use the router as a pivot point into connected internal networks. The vulnerability is rated Critical with CVSS v3.1 9.8.

If a patch is not yet available, restrict access to the WAH7601 web management interface to trusted administrative networks or specific trusted IP addresses only. Remove the management interface from public internet exposure. If adequate access controls cannot be enforced, take the device offline or replace it with a supported alternative. Additional defensive hardening should include minimizing exposure of administrative services and validating or constraining user-supplied input where operationally possible.

Apply a vendor firmware update that addresses CVE-2026-13206 as soon as Zyxel releases one. Affected devices are reported vulnerable through build 20072026, so remediation requires upgrading to a fixed release newer than that affected build once available. Organizations should monitor Zyxel security advisories for the availability of an official patch.