Zyxel released an advisory on August 4, 2026, confirming that the flaw impacts 39 models, including 36 access points, two FWA7 series devices, and one security router. The vulnerability enables an attacker with network adjacency to bypass captive portal restrictions, potentially granting unauthorized access to the network or services protected by the captive portal.

Impact

Successful exploitation allows unauthenticated attackers with network adjacency to bypass captive portal authentication. This grants the attacker a valid guest authentication cookie, enabling unauthorized network access. The vulnerability affects 39 distinct Zyxel models, increasing the risk surface for enterprise and public-facing deployments utilizing Zyxel captive portal social login features.

Recommendation

• Prioritize patching all affected Zyxel devices as identified in the manufacturer's August 4, 2026, advisory.
• Monitor logs for anomalous POST requests directed at '/cgi-bin/social_login.cgi' originating from the guest or public-facing network segments.
• Deploy network-level access control to restrict access to management and CGI interfaces from untrusted or public network interfaces.
• Verify firmware versions across the 36 affected access points, FWA7 series, and the impacted security router model.

Attack Chain

1. Attacker performs credential theft or brute-force to obtain administrator-level access to the web management interface.
2. Attacker logs into the device management console via HTTP or HTTPS.
3. Attacker navigates to or directly crafts a request to the 'export-cgi' endpoint.
4. Attacker injects malicious OS command sequences into the request parameters processed by 'export-cgi'.
5. The CGI program fails to neutralize shell metacharacters, passing the input directly to the system shell.
6. The system executes the injected commands with the privileges of the web service process.
7. Attacker establishes persistent access or exfiltrates configuration data from the device.

Impact

Successful exploitation allows for full control of the affected Zyxel WAX650S access point. This can lead to total loss of device confidentiality, integrity, and availability, as well as the potential for the device to be used as a pivot point for further lateral movement within the network.

Recommendation

• Apply the vendor-provided firmware update that addresses CVE-2026-6837 on all Zyxel WAX650S units immediately.
• Audit web server access logs for anomalous POST or GET requests directed at 'export-cgi' by known administrative accounts.
• Limit access to the device management interface to specific internal management VLANs or dedicated jump hosts to minimize the exposure of administrative endpoints.
• Monitor for unexpected system processes or network connections originating from the WAX650S device.