This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Zyxel fixes 3 vulnerabilities

Zyxel fixes 3 vulnerabilities in specific firmware versions of the following products: - ATP - USG FLEX - USG FLEX 50(W)/USG20(W)-VPN - AP - FWA7 - Security Routers A clear table of all fixed versions and the corresponding devices can be found at [1][2].

Zyxel ATP, USG FLEX - command execution (CVE-2026-14818)
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can execute a planted malicious configuration file on the affected device due to a path traversal vulnerability [1][3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-14818 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 8. 2026.

Zyxel APs, FWA7, Security Routers - command injection (CVE-2026-6837)
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can execute arbitrary operating system commands on the affected device due to insufficient input sanitization in the CGI program "export-cgi" [2][4].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-6837 at cve.org, NVD
  • CWE-78: Improper neutralization of special elements used in an OS command ('OS command injection') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 8. 2026.

Zyxel APs, FWA7, Security Routers - authentication bypass (CVE-2026-8508)
CVSS 6.5 (Medium)

An unauthenticated attacker within WLAN range can bypass captive portal authentication due to improper verification in the CGI program "social_login.cgi" [2][5].

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 4. 8. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 4. 8. 2026.

CESNET, z.s.p.o. Logo