Post-authentication Command Injection in Zyxel Syslog LogServer Field

Successful exploitation allows a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands on the affected device. This can result in full compromise of the appliance at the OS level, including unauthorized configuration changes, service disruption, access to sensitive device-resident data, establishment of persistence, and use of the device as a pivot point for further activity within the local network or managed environment.

If immediate patching is not possible, reduce exposure by restricting management access to trusted administrative networks only, disabling or tightly limiting remote administrative access paths, and ensuring WAN-side management remains disabled unless strictly required. Enforce strong unique administrator credentials, rotate any potentially exposed passwords, and monitor for unauthorized configuration changes involving syslog settings and other administrative functions. Because exploitation requires valid administrator access, credential hygiene and management-plane access control materially reduce risk until patched firmware is installed.

Apply the vendor-provided fixed firmware for the affected model and firmware branch. Zyxel published patched releases for affected product lines, including AX7501-B1 fixed in 5.17(ABPC.8)C0. For other affected DSL/Ethernet CPE, fiber ONT, and wireless extender models, upgrade to the specific corrected firmware versions identified by Zyxel for each model. Where firmware distribution is handled by an ISP or channel partner, obtain and deploy the patched image through that provider or Zyxel support.