CVE-2026-6837

A post-authentication command injection vulnerability exists in the "export-cgi" CGI program of Zyxel WAX650S firmware versions up to 7.10(ABRM.4)C0, allowing authenticated attackers with administrator privileges to execute arbitrary OS commands on the device. This high-severity flaw poses a significant risk to network security, as it can lead to unauthorized access and control over affected devices. Organizations using the specified firmware should prioritize patching this vulnerability to mitigate potential exploitation.