Description

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T13:17:56.020Z",
  "pubdate": "2026-08-10T13:17:56.020Z",
  "executiveSummary": "An improper neutralization of special elements used in an OS command vulnerability, classified as OS Command Injection, has been identified in Zyxel Networks WAH7601 devices.\nThis security flaw allows remote attackers to execute arbitrary operating system commands with the privileges of the underlying application, leading to total system compromise.\nThe vulnerability specifically impacts the Zyxel Networks WAH7601 mobile Wi-Fi hotspot product for all firmware versions through 20072026.\nSuccessful exploitation of this vulnerability carries severe risk implications, potentially enabling malicious actors to intercept network traffic, modify device configurations, or leverage the compromised hardware as a pivot point for further network intrusions.\nAttacker capabilities include arbitrary command execution, which typically requires network access to the vulnerable device.\nOrganizations and users utilizing the affected product face significant security exposure until appropriate remediation steps are applied.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and improper sanitization of special characters within parameters processed by the underlying operating system shell.\nThe affected component within the Zyxel Networks WAH7601 handles user-supplied input that is subsequently passed directly to system execution functions without adequate neutralization.\nWhen an attacker submits specially crafted input containing OS command metacharacters, the application fails to filter these elements, allowing them to be interpreted and executed by the command interpreter.\nThe attack flow begins with the transmission of a malicious payload targeting the vulnerable parameter or interface exposed by the WAH7601 firmware.\nUpon receiving the input, the vulnerable component constructs a system command string incorporating the unsanitized data.\nThe operating system executes the resulting command string, granting the attacker the execution context and privilege level of the application process.\nThis vulnerability affects Zyxel Networks WAH7601 firmware versions through 20072026.\nDepending on the operational configuration and network exposure of the device, exploitation may be performed over the local area network or wide area network interfaces.\nPost-exploitation impact includes full administrative control over the affected device, persistent compromise of the firmware environment, and potential manipulation of routing or traffic handling capabilities."
}