Zyxel security advisory for post-authentication command injection vulnerability in certain DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders

CVE: CVE-2026-6952

Summary

Zyxel has released patches for specific firmware versions of its DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders. These updates address the command injection vulnerability. Users are strongly advised to install the patches to ensure optimal protection.

What is the vulnerability?

CVE-2026-6952

A post-authentication command injection vulnerability in the “LogServer” field of the syslog component in certain firmware versions for DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device. It is important to note that WAN access is disabled by default on these devices, and this attack can succeed only if user-configured passwords have been compromised.

What versions are vulnerable—and what should you do?

After a thorough investigation, we identified the affected products still within their vulnerability support period and released firmware patches to address the issue, as shown in the table below. Please note that the table does not include customized models specifically designed for ISP customers. Any product currently on the market that is not listed in the table is not affected.

Got a question?

For our ISP customers, please contact your Zyxel sales or service representatives for more information. For customers who have acquired Zyxel devices through an ISP, please directly contact your ISP's support team, as the devices may have custom configurations.

Acknowledgment

Thanks to William Honnér for reporting the issue to us.

Revision history

2026-07-21: Initial release