Zyxel's New AP Patches: Why the Smaller CVSS Number Matters More

Part of what we do at store.tyo.com.au is keep an eye on the security advisories for the kind of networking gear our customers actually run, so you don't have to spend your Friday reading CVE databases. A fortnight ago that meant Zyxel's home modem-routers and extenders. This week Zyxel is back — but this time it's the business gear: the Wi-Fi access points screwed to office ceilings, plus a couple of its small-business routers.

There are two flaws in the one advisory, and they make a genuinely useful pair — because the one with the higher severity score is, for most small businesses, the less relevant of the two. That's the lesson this post is really about.

What happened, in plain English

On 4 August 2026, Zyxel published a security advisory covering two vulnerabilities, both reported by researcher Mina Nageh Salama, both patched.

The headline flaw: CVE-2026-6837 (CVSS 7.2, High). This is a command-injection bug (CWE-78) in a CGI program called export-cgi on eighteen of Zyxel's business access point models — the NWA and WAX families, including the WAX650S, WAX630S, WAX610D and NWA110AX. If exploited, it lets an attacker run operating-system commands on the access point itself: full control of the box.

But — and this is the fine print that matters — it is strictly post-authentication, and it requires administrator privileges. The CVSS vector spells it out: PR:H, privileges required: high. An attacker has to already be logged in as the admin of your access point before any of this works. Nobody on the internet can fire this at you anonymously. The fix is firmware 7.12(X)C0 for the affected AP models.

The quieter flaw: CVE-2026-8508 (CVSS 6.5, Medium). This one is an improper-authentication bug (CWE-287) in a CGI program called social_login.cgi, and it lets an attacker on the wireless network bypass captive portal authentication — with no credentials at all. It affects a much wider spread of gear: roughly thirty-five AP models across the NWA, WAC, WAX and Wi-Fi 7 WBE families, plus the FWA7 Leaf Plus and Root Plus 5G fixed-wireless units and the USG LITE 60AX security router. Fixes are out for these too (firmware 7.12, 7.40 or 2.40 depending on the product line, with a hotfix for the WAC500H available from Zyxel support).

One more piece of honest context: neither flaw is being exploited in the wild as far as anyone can tell. Neither is on CISA's Known Exploited Vulnerabilities list, and CISA's own assessment of both records "exploitation: none" as of early August. This is a patch-on-your-schedule situation, not a fire alarm.

Why the smaller number is the interesting one

Here's the thing about severity scores: CVSS measures how bad a flaw is in the abstract. It doesn't measure how exposed you are.

The 7.2-scored command injection sounds worse — and technically it is, because "run any command on the device" is about as bad as outcomes get. But it sits behind a locked door: someone needs your admin password first. If your admin credentials are strong, unique and not exposed to the internet, the realistic path to this bug is narrow. (If they're not — that's the actual problem, and it was the actual problem long before this CVE existed.)

The 6.5-scored captive portal bypass scores lower for one main reason: the attacker has to be within radio range of your Wi-Fi (AV:A, adjacent network). But look at what it doesn't require: no password, no admin account, no user interaction. Anyone sitting in your car park, your waiting room or the café next door could potentially walk straight past the guest-network login page.

For a lot of small businesses — the clinic with patient Wi-Fi, the café with a splash page, the office with a "Guest" SSID for visitors — that second flaw touches something they actually rely on every day. What does a bypass get an attacker? At minimum, free use of your internet connection under your name. At worst, if your guest network isn't properly walled off from your business network, it's a foothold on the inside of your fence.

Which leads to the real lesson, and it isn't about Zyxel: a captive portal is a sign-in page, not a security boundary. The thing that actually protects your business systems from whoever is on the guest Wi-Fi is network segregation — a separate VLAN, client isolation, and firewall rules that give guests a path to the internet and nothing else. If your setup depends on the portal itself keeping strangers out, this advisory is your nudge to fix that, regardless of what brand is on your ceiling.

The honest bit

We'll say what we always say: no vendor is immune, including the ones we like. The WAX650S and its siblings are exactly the class of business-grade access point we'd happily see in a customer's office, and here they are in an advisory — just as Cisco's gear has been in ours before (see the Cisco RV story). To Zyxel's credit, the handling here is what good looks like: a clear advisory that states the privilege requirements plainly, patches shipped for current hardware across three product lines, and the researcher publicly credited.

One genuine difference worth noting, lightly. Advisories like this are also a test of how your gear gets patched. Access points managed through a cloud platform — Zyxel's Nebula, Cisco's Meraki, and others — can have firmware updates scheduled and pushed fleet-wide from one console, so eighteen ceiling-mounted APs don't have to be updated one ladder at a time. We've written before about why that model quietly keeps paying off. It's not a reason to change brands; it is a real thing to weigh when you next buy.

What we'd suggest you actually do

No upsell — just the sensible checklist:

1. Check your ceilings and comms cupboard. If you run Zyxel NWA, WAC, WAX or WBE access points, an FWA7 fixed-wireless unit or a USG LITE 60AX router, look up your exact model in Zyxel's advisory (linked below) — the two flaws have different affected lists.
2. Apply the firmware updates — 7.12(X)C0 for the affected APs, and the listed versions for the FWA7 and USG LITE 60AX. If your APs are managed through Nebula, schedule the upgrade from the console. No known exploitation means this can wait for a maintenance window; it shouldn't wait for next quarter.
3. Treat your guest Wi-Fi as hostile, portal or no portal. Confirm the guest SSID sits on its own VLAN with client isolation on, and that guests can reach the internet and nothing else. This protects you from every captive-portal flaw, not just this one.
4. Do the admin-password basics. The 7.2 flaw is only reachable through an admin login — so make that password strong and unique, and don't expose management interfaces where they don't need to be.
5. Take the five-minute inventory pass. What Wi-Fi and routing gear do you have, what firmware is it on, and is any of it past end-of-support? Forgotten gear is where advisories like this eventually bite — a pattern we covered in our forgotten-gear post.

The friendly takeaway

Two real bugs, both patched, neither being exploited — update on your schedule and move on. The keeper is the lesson underneath: severity scores rank flaws, not your risk. An "admin-only" critical behind a strong password may matter less to you than a "medium" that anyone in the car park can reach. And your guest Wi-Fi should be built so that a broken sign-in page costs you nothing but bandwidth.

If you'd like a second pair of eyes on whether these models are on your network, whether your guest Wi-Fi is properly segregated, or what an advisory like this means for your setup — we're happy to look. No obligation, no hard sell. That's the point of us watching this feed: so you can get on with running your business. And if you're wondering whether you'd even notice someone slipping onto your network, we've written about that too.

References

• Zyxel security advisory (4 August 2026): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026
• NVD — CVE-2026-6837 (CVSS 7.2 High, vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-78): https://nvd.nist.gov/vuln/detail/CVE-2026-6837
• NVD — CVE-2026-8508 (CVSS 6.5 Medium, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, CWE-287): https://nvd.nist.gov/vuln/detail/CVE-2026-8508
• CISA Known Exploited Vulnerabilities Catalog (neither CVE listed as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog