Vendor
Zyxel NWA110AX: Buffer overflow in zdp_wtp binary (CVE-2026-76955)
1 CVEA buffer overflow vulnerability in the zdp_wtp binary of Zyxel NWA110AX allows for LAN-based privilege escalation.
Zyxel GS1900-24E: Out-of-bounds write vulnerability (CVE-2026-107441)
1 CVEAn out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to potentially execute OS commands via a crafted HTTP request.
WordPress Exploitation and Data Exfiltration by Red Heron Affiliate
1 rule 2 TTPs 5 CVEs 3 IOCsAn adversary linked to the Red Heron group is exploiting multiple vulnerabilities in WordPress, Ubiquiti, and ZyXEL devices to conduct reconnaissance, gain persistence, and exfiltrate sensitive records, including over 18,000 government documents.
Pre-Authentication Trust Boundary Vulnerability in Zyxel Social Login
1 rule 1 TTP 1 CVEA pre-authentication trust-boundary flaw in Zyxel network devices, tracked as CVE-2026-8508, allows unauthenticated attackers to bypass captive portal authentication via crafted POST requests to the social_login.cgi endpoint.
OS Command Injection Vulnerability in Zyxel WAH7601
3 TTPs 1 CVEAn OS command injection vulnerability in Zyxel WAH7601 devices (CVE-2026-13206) allows unauthenticated remote attackers to execute arbitrary system commands.
Remote Code Execution Vulnerability in Zyxel Firewalls
1 TTPA vulnerability in Zyxel firewall firmware allows a remote, authenticated attacker to achieve arbitrary code execution on the device.
Path Traversal Vulnerability in Zyxel Network Appliance CLI
1 TTP 1 CVEAn authenticated path traversal vulnerability in Zyxel ATP and USG series firmware allows administrators to execute arbitrary configuration files, potentially leading to command execution.
Command Injection in Zyxel WAX650S export-cgi
1 rule 1 TTP 1 CVEAn authenticated administrator can exploit a command injection vulnerability in the export-cgi program of Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 to execute arbitrary OS commands.
Zyxel AX7501-B1 Firmware Command Injection (CVE-2026-6952)
1 TTP 1 CVEA post-authentication command injection vulnerability (CVE-2026-6952) in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 allows an authenticated attacker with administrator privileges to execute arbitrary OS commands on the affected device.
CVE-2026-7287 - Zyxel NWA1100-N Buffer Overflow Vulnerability
2 rules 2 TTPs 1 CVEA buffer overflow vulnerability in Zyxel NWA1100-N firmware allows a remote attacker to cause a denial-of-service by sending a crafted HTTP request to the webs binary.
Zyxel WRE6505 v2 Command Injection Vulnerability (CVE-2026-7256)
2 rules 1 TTP 1 CVEA command injection vulnerability (CVE-2026-7256) in Zyxel WRE6505 v2 firmware allows an adjacent attacker on the LAN to execute arbitrary OS commands by sending a crafted HTTP request.
Zyxel Command Injection Vulnerabilities in CPE and Extenders
2 rules 1 TTPZyxel released a security advisory on April 28, 2026, addressing command injection vulnerabilities across multiple versions of their 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extender products, potentially allowing attackers to execute arbitrary commands.