Zyxel security advisory for buffer overflow vulnerability in certain APs, FWA7, and Security Routers
CVE: CVE-2026-76955
Summary
Zyxel has released patches for specific firmware versions of its APs, FWA7, and Security Routers to address a buffer overflow vulnerability. Users are strongly advised to install the patches to ensure optimal protection.
What is the vulnerability?
CVE-2026-76955
The buffer overflow vulnerability in the zdp_wtp binary in certain firmware versions of APs, FWA7, and Security Routers could allow a LAN-based attacker to escalate privileges on an affected device.
What versions are vulnerable—and what should you do?
Following a comprehensive investigation, we identified the affected firmware versions and released patches for models still within their vulnerability support period, as indicated in the table below. Please note that on-market products not listed in the tables are not affected.
| Product | Affected model | Affected version | Patch availability |
|---|---|---|---|
| AP | IAP500BE | 7.40(ACPJ.1)C0 and earlier | 7.40(ACPJ.2)C0 |
| NWA110AX | 7.12(ABTG.0)C0 and earlier | 7.12(ABTG.1)C0 | |
| NWA110BE | 7.40(ACLZ.1)C0 and earlier | 7.40(ACLZ.2)C0 | |
| NWA130BE | 7.40(ACIL.1)C0 and earlier | 7.40(ACIL.2)C0 | |
| NWA210AX | 7.12(ABTD.0)C0 and earlier | 7.12(ABTD.1)C0 | |
| NWA210AXv2 | 7.40(ACSR.1)C0 and earlier | 7.40(ACSR.2)C0 | |
| NWA210BE | 7.40(ACLY.1)C0 and earlier | 7.40(ACLY.2)C0 | |
| NWA220AX-6E | 7.12(ACCO.0)C0 and earlier | 7.12(ACCO.1)C0 | |
| NWA240BE | 7.40(ACQG.1)C0 and earlier | 7.40(ACQG.2)C0 | |
| NWA30BE | 7.40(ACPI.1)C0 and earlier | 7.40(ACPI.2)C0 | |
| NWA50AX | 7.12(ABYW.0)C0 and earlier | 7.12(ABYW.1)C0 | |
| NWA50AX PRO | 7.12(ACGE.0)C0 and earlier | 7.12(ACGE.1)C0 | |
| NWA50BE | 7.40(ACPB.1)C0 and earlier | 7.40(ACPB.2)C0 | |
| NWA50BE MAX | 7.40(ACTP.1)C0 and earlier | 7.40(ACTP.2)C0 | |
| NWA50BE PRO | 7.40(ACPC.1)C0 and earlier | 7.40(ACPC.2)C0 | |
| NWA55AX PRO | 7.12(ACSP.0)C0 and earlier | 7.12(ACSP.1)C0 | |
| NWA55AX PTP | 7.12(ACSQ.0)C0 and earlier | 7.12(ACSQ.1)C0 | |
| NWA55AXE | 7.12(ABZL.0)C0 and earlier | 7.12(ABZL.1)C0 | |
| NWA55BE | 7.40(ACPH.1)C0 and earlier | 7.40(ACPH.2)C0 | |
| NWA90AX | 7.12(ACCV.0)C0 and earlier | 7.12(ACCV.1)C0 | |
| NWA90AX PRO | 7.12(ACGF.0)C0 and earlier | 7.12(ACGF.1)C0 | |
| NWA90BE | 7.40(ACPD.1)C0 and earlier | 7.40(ACPD.2)C0 | |
| NWA90BE MAX | 7.40(ACTQ.1)C0 and earlier | 7.40(ACTQ.2)C0 | |
| NWA90BE PRO | 7.40(ACPE.1)C0 and earlier | 7.40(ACPE.2)C0 | |
| WAC500H | 6.70(ABWA.7)C0 and earlier | Hotfix is available upon request* | |
| WAX300H | 7.12(ACHF.0)C0 and earlier | 7.12(ACHF.1)C0 | |
| WAX510D | 7.12(ABTF.0)C0 and earlier | 7.12(ABTF.1)C0 | |
| WAX610D | 7.12(ABTE.0)C0 and earlier | 7.12(ABTE.1)C0 | |
| WAX620D-6E | 7.12(ACCN.0)C0 and earlier | 7.12(ACCN.1)C0 | |
| WAX630S | 7.12(ABZD.0)C0 and earlier | 7.12(ABZD.1)C0 | |
| WAX640S-6E | 7.12(ACCM.0)C0 and earlier | 7.12(ACCM.1)C0 | |
| WAX650S | 7.12(ABRM.0)C0 and earlier | 7.12(ABRM.1)C0 | |
| WAX655E | 7.12(ACDO.0)C0 and earlier | 7.12(ACDO.1)C0 | |
| WBE510D | 7.40(ACLX.1)C0 and earlier | 7.40(ACLX.2)C0 | |
| WBE530 | 7.40(ACLE.1)C0 and earlier | 7.40(ACLE.2)C0 | |
| WBE630S | 7.40(ACLW.1)C0 and earlier | 7.40(ACLW.2)C0 | |
| WBE660S | 7.40(ACGG.1)C0 and earlier | 7.40(ACGG.2)C0 | |
| WBE665S | 7.40(ACQJ.1)C0 and earlier | 7.40(ACQJ.2)C0 | |
| FWA7 | FWA7 Leaf Plus | 7.40(ACQL.1)C0 and earlier | 7.40(ACQL.2)C0 |
| FWA7 Root | 7.40(ACUJ.1)C0 and earlier | 7.40(ACUJ.2)C0 | |
| FWA7 Root Plus | 7.40(ACQK.1)C0 and earlier | 7.40(ACQK.2)C0 | |
| Security Routers | USG LITE 60AX | V2.00(ACIP.0)C0 to V2.30(ACIP.1)C0 | V2.40(ACIP.0)C0** |
* Please reach out to your local Zyxel support team for the file.
** Updated by cloud.
Got a question?
Please contact your local service rep or visit Zyxel's Community for further information or assistance.
Acknowledgment
Thanks to Jinpyo Lee for reporting the issue to us.
Revision history
2026-11-3: Initial release