# CVE-2026-13206: Zyxel WAH7601 OS command injection

Source: https://junglewise.ai/threats/cve-2026-13206-zyxel-wah7601-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13206 · Severity: critical · CVSS 9.8 · Published 2026-08-10

The Zyxel WAH7601 is a wireless access point used to provide network connectivity in corporate and public environments. An OS command injection vulnerability allows remote attackers to execute arbitrary system commands on the device, potentially leading to complete compromise of the access point, unauthorized network access, and lateral movement to connected networks.

Vendors: [Zyxel](https://junglewise.ai/threats/vendors/zyxel).

## Quick answers

**Is CVE-2026-13206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13206 being exploited in the wild.

**How severe is CVE-2026-13206?** Critical severity, with a CVSS score of 9.8, published 10 August 2026.

**Which products and versions are affected?** Zyxel WAH7601 through 20072026.

**Is there a fix for CVE-2026-13206?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13206 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-13206?** Check whether you run Zyxel WAH7601 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw in the WAH7601 wireless access point, caused by improper neutralization of special characters used in operating system commands. The vulnerability is remotely exploitable without authentication required, as indicated by the CVSS 9.8 score and attack vector classification. An attacker can craft malicious input to the device that breaks out of intended command boundaries and execute arbitrary OS-level commands with the privileges of the access point process. This grants full control over the device, allowing attacker to modify configurations, intercept traffic, or use it as a pivot point for network attacks.

## Affected products

- Zyxel WAH7601 through 20072026

## Timeline

- 2026-08-10: disclosed

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0799](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0799)