# CVE-2026-7256: Zyxel WRE6505 v2 command injection in CGI program

Source: https://junglewise.ai/threats/cve-2026-7256-zyxel-wre6505-v2-command-injection-in-cgi-program  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-7256 · Severity: high · CVSS 8.8 · Published 2026-05-12

A security vulnerability has been identified in the Zyxel WRE6505 v2, a wireless range extender used to boost WiFi signals. An attacker on the same local network could take complete control of the device by sending a specially crafted web request. Because this product has reached its end-of-life, the manufacturer is not providing a security patch, leaving affected devices permanently vulnerable.

Technologies: [Zyxel Wre6505](https://junglewise.ai/threats/technologies/wre6505), [Zyxel Wre6505 Firmware](https://junglewise.ai/threats/technologies/wre6505-firmware). Vendors: [Zyxel](https://junglewise.ai/threats/vendors/zyxel).

## Quick answers

**Is CVE-2026-7256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7256 being exploited in the wild.

**How severe is CVE-2026-7256?** High severity, with a CVSS score of 8.8, published 12 May 2026.

**Which products and versions are affected?** Zyxel WRE6505 v2 V1.00(ABDV.3)C0.

**Is there a fix for CVE-2026-7256?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7256 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-7256?** Check whether you run Zyxel Wre6505, Zyxel WRE6505 v2 or Zyxel Wre6505 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-78) exists within the CGI program of the Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. The flaw is triggered by insufficient sanitization of input in HTTP requests, allowing an attacker located on the same local area network (LAN) to execute arbitrary operating system commands without authentication. This vulnerability is classified as 'Unsupported When Assigned' because the affected hardware has reached its End-of-Life (EOL) status, and Zyxel has indicated that no further security updates or patches will be released.

## Affected products

- Zyxel WRE6505 v2 V1.00(ABDV.3)C0

## Timeline

- 2026-05-12: disclosed: CVE published and marked as unsupported by vendor

## References

- [https://www.zyxel.com/global/en/support/end-of-life](https://www.zyxel.com/global/en/support/end-of-life)

## Related threats

- [Zyxel WRE6505 v2 Insecure Storage in Configuration File](https://junglewise.ai/threats/cve-2026-7257-zyxel-wre6505-v2-insecure-storage-in-configuration-file)
- [Zyxel WRE6505 v2 improper authentication restriction in web interface](https://junglewise.ai/threats/cve-2026-7255-zyxel-wre6505-v2-improper-authentication-restriction-in-web)
- [Zyxel WRE6505 v2 improper encoding DoS in CGI program](https://junglewise.ai/threats/cve-2026-6058-zyxel-wre6505-v2-improper-encoding-dos-in-cgi-program)