✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

TP-Link Archer Vulnerabilities Allow Command Injection Attacks

August 25, 2026
What-Is-Detection-Engineering-and-How-AI-Is-Transforming-Security-Detection

What Is Detection Engineering and How AI Is Transforming Security Detection

August 25, 2026

Zyxel Patches Command Injection Flaw in 18 Access Points

Severity

High

Analysis Summary

Zyxel has released firmware updates to address a high-severity command injection vulnerability, tracked as CVE-2026-6837, affecting 18 wireless access point models. The flaw resides in the export-cgi component and is associated with the PKCS#12 certificate export functionality. Specifically, the certificate export password is incorporated into a shell command without adequate argument handling or neutralization. An authenticated administrator could supply specially crafted input containing shell metacharacters, escape the intended command context, and execute arbitrary operating-system commands. Because the vulnerable CGI process operates with highly privileged permissions, successful exploitation can result in root-level command execution and complete compromise of the affected access point.

Technical analysis of Zyxel WAX650S firmware version 7.10(ABRM.4)C0 demonstrated how the vulnerable export-cgi component constructs a command string using certificate-export parameters before passing it to the system shell. Characters such as quotation marks can modify the structure of the generated command and allow additional commands to be executed. Researcher reproduced the proof of concept in a fully emulated WAX650S user-space environment rather than on physical hardware. The research environment used extracted AArch64 firmware, qemu-aarch64-static, Bubblewrap, Python, Bash, and a recreated web-handler environment to reach the Lighttpd and export-cgi request path, initialize required IPC services, and observe command output through the HTTP response.

The vulnerability is classified as CWE-78, involving improper neutralization of special elements used in operating-system commands. Although the flaw is post-authentication and requires a valid administrator session, the impact remains serious because attackers who obtain administrative credentials through credential theft, reuse, exposed management interfaces, or insider access could potentially gain complete control of the device. The affected models include NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E. Zyxel's August 4, 2026 advisory identifies firmware 7.12 builds as the fixed release line, with WAX650S specifically requiring version 7.12(ABRM.0)C0.

Organizations should immediately identify vulnerable Zyxel access points and install the appropriate fixed firmware. Administrative interfaces should not be exposed to untrusted or Internet-facing networks and should instead be restricted through network segmentation and access controls. Privileged credentials should be rotated if compromise or exposure is suspected, while device and management logs should be reviewed for unusual authentication, certificate-export, or administrative activity. From a secure-development perspective, the vulnerability highlights the risks of dynamically constructing shell commands from user-controlled input. Firmware developers should use non-shell execution mechanisms with separately defined arguments and strict input validation rather than relying on quoting or escaping within dynamically assembled command strings.

Impact

  • Gain Access

Indicators of Compromise

CVE

  • CVE-2026-6837

Remediation

  • Update all affected Zyxel access points to the latest firmware containing the security fix. For the WAX650S, upgrade to 7.12(ABRM.0)C0.
  • Identify all 18 affected models across the organization and verify that each device is running a patched firmware version.
  • Restrict web-based administrative interfaces from being accessible over the Internet or other untrusted networks.
  • Implement network segmentation to isolate wireless access points and prevent compromised devices from reaching critical internal systems.
  • Review administrator accounts and rotate privileged credentials if there is any possibility of credential exposure or compromise.
  • Enforce strong, unique administrator passwords and disable unused administrative accounts.
  • Monitor device and management logs for suspicious administrator logins, certificate-export activity, unexpected configuration changes, or unusual command execution.
  • Apply the principle of least privilege by limiting administrative access to authorized personnel only.
  • Regularly monitor Zyxel security advisories and firmware releases to ensure newly disclosed vulnerabilities are addressed promptly.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo