Quick answers
- Is CVE-2026-13206 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13206 being exploited in the wild.
- How severe is CVE-2026-13206?
- Critical severity, with a CVSS score of 9.8, published 10 August 2026.
- Which products and versions are affected?
- Zyxel WAH7601 through 20072026.
- Is there a fix for CVE-2026-13206?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-13206 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-13206?
- Check whether you run Zyxel WAH7601 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an OS command injection flaw in the WAH7601 wireless access point, caused by improper neutralization of special characters used in operating system commands. The vulnerability is remotely exploitable without authentication required, as indicated by the CVSS 9.8 score and attack vector classification. An attacker can craft malicious input to the device that breaks out of intended command boundaries and execute arbitrary OS-level commands with the privileges of the access point process. This grants full control over the device, allowing attacker to modify configurations, intercept traffic, or use it as a pivot point for network attacks.
Affected products
- Zyxel WAH7601 through 20072026
Timeline
- 2026-08-10: disclosed