CVE-2026-6952: Zyxel AX7501-B1 RCE Vulnerability

CVE-2026-6952 Overview

CVE-2026-6952 is a post-authentication command injection vulnerability in the Zyxel AX7501-B1 fiber ONT device. The flaw resides in the LogServer field of the syslog configuration component. An authenticated attacker with administrator privileges can inject operating system commands that execute on the underlying device. The vulnerability affects firmware versions through 5.17(ABPC.7.2)C0 and is tracked under [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated administrators can achieve arbitrary OS command execution on affected Zyxel AX7501-B1 devices, leading to full compromise of the customer premises equipment (CPE).

Affected Products

Zyxel AX7501-B1 fiber ONT firmware versions through 5.17(ABPC.7.2)C0
Related Zyxel DSL, Ethernet CPE, fiber ONT, and wireless extender products referenced in the vendor advisory
Deployments where the device web management interface is reachable by administrative users

Discovery Timeline

2026-07-21 - CVE-2026-6952 published to NVD
2026-07-21 - Zyxel publishes security advisory for the affected CPE, ONT, and extender product lines
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-6952

Vulnerability Analysis

The vulnerability is a classic OS command injection flaw in the syslog configuration handler of the AX7501-B1 firmware. The device exposes a LogServer parameter that accepts a hostname or address for remote syslog forwarding. Input supplied to this field is passed to an underlying shell invocation without sufficient neutralization of shell metacharacters. An authenticated administrator can embed shell separators such as ;, |, or backticks inside the LogServer value to append arbitrary commands.

Because the syslog subsystem on embedded CPE devices typically runs with elevated privileges, injected commands execute in the context of the device operating system. The result is full command execution, including the ability to read configuration, pivot into the ISP-facing management channel, or persist through firmware modification.

Root Cause

The root cause is missing input validation and unsafe command construction in the syslog handler. The LogServer value is concatenated into a shell command line rather than being passed as a discrete argument to a syslog daemon or validated against a strict hostname or IP pattern. This is the pattern captured by [CWE-78].

Attack Vector

Exploitation requires network access to the device management interface and valid administrator credentials. An attacker submits a crafted syslog configuration request that stores a malicious LogServer value. When the device applies the configuration and starts or reloads the syslog process, the injected commands execute. Exploitation does not require user interaction beyond the attacker's authenticated session.

No public proof-of-concept exploit is available for CVE-2026-6952 at the time of publication. Technical details are described in prose only. See the Zyxel Security Advisory for vendor-supplied context.

Detection Methods for CVE-2026-6952

Indicators of Compromise

Syslog configuration entries where the LogServer value contains shell metacharacters such as ;, |, &, $(, or backticks.
Unexpected outbound connections initiated by the device to hosts other than the configured syslog collector.
Changes to device configuration, firmware, or administrative accounts that do not correspond to authorized change tickets.

Detection Strategies

Audit device configuration exports for the LogServer field and alert on any value that is not a strict hostname or IP address.
Correlate administrator login events with subsequent syslog configuration changes to identify suspicious sequences.
Inspect HTTP or CWMP management traffic for POST requests that set syslog parameters containing command separators.

Monitoring Recommendations

Forward device logs to a central SIEM and alert on configuration change events targeting syslog settings.
Monitor for administrator authentication from unusual source addresses or outside expected maintenance windows.
Track device process and network telemetry, where available, for shell invocations spawned by the syslog subsystem.

How to Mitigate CVE-2026-6952

Immediate Actions Required

Apply the firmware update referenced in the Zyxel security advisory as soon as it is available for the AX7501-B1 platform.
Restrict management interface access to trusted administrative networks using ACLs or firewall rules.
Rotate administrator credentials and enforce strong, unique passwords on all affected devices.
Review recent syslog configuration changes and revert any LogServer values containing shell metacharacters.

Patch Information

Zyxel has published a security advisory covering command injection in DSL, Ethernet CPE, fiber ONT, and wireless extender product lines. Refer to the Zyxel Security Advisory for the current fixed firmware version for the AX7501-B1 and related models.

Workarounds

Disable remote administration on the WAN interface and permit management only from the LAN or a dedicated management VLAN.
Limit the number of accounts with administrator privileges and enable multi-factor authentication where the platform supports it.
Configure the LogServer value to a fixed IP address and monitor for any modifications to that setting.

bash

# Configuration example - restrict management access
# Replace 192.0.2.0/24 with your trusted management network
configure terminal
  ip access-list mgmt-acl
    permit 192.0.2.0/24
    deny any
  interface wan0
    ip access-group mgmt-acl in
    no http server
    no https server
end
write memory