# CVE-2026-76955: Zyxel NWA110AX buffer overflow in zdp_wtp

Source: https://junglewise.ai/threats/cve-2026-76955-a-buffer-overflow-vulnerability-in-the-zdp-wtp-binary-in-zyxel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-76955 · Severity: high · CVSS 8.8 · Published 2026-11-03

A buffer overflow flaw in Zyxel wireless access points could allow an attacker on the local network to gain administrator privileges on the device. An attacker with access to the network could take over the device and potentially compromise network traffic or deploy additional malware. Affected models include NWA110AX and other NWA series access points through specific firmware versions.

Vendors: [Zyxel](https://junglewise.ai/threats/vendors/zyxel).

## Quick answers

**Is CVE-2026-76955 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76955 being exploited in the wild.

**How severe is CVE-2026-76955?** High severity, with a CVSS score of 8.8, published 3 November 2026.

**Which products and versions are affected?** Zyxel IAP500BE 7.40(ACPJ.1)C0 and earlier; Zyxel NWA110AX 7.12(ABTG.0)C0 and earlier; Zyxel NWA110BE 7.40(ACLZ.1)C0 and earlier; Zyxel NWA130BE 7.40(ACIL.1)C0 and earlier; and 15 more.

**Is there a fix for CVE-2026-76955?** Yes: fixed in IAP500BE 7.40(ACPJ.2)C0; NWA110AX 7.12(ABTG.1)C0; NWA110BE 7.40(ACLZ.2)C0; NWA130BE 7.40(ACIL.2)C0; NWA210AX 7.12(ABTD.1)C0; NWA210AXv2 7.40(ACSR.2)C0; NWA210BE 7.40(ACLY.2)C0; NWA220AX-6E 7.12(ACCO.1)C0; NWA240BE 7.40(ACQG.2)C0; NWA30BE 7.40(ACPI.2)C0; NWA50AX 7.12(ABYW.1)C0; NWA50AX PRO 7.12(ACGE.1)C0; NWA50BE 7.40(ACPB.2)C0; NWA50BE MAX 7.40(ACTP.2)C0; NWA50BE PRO 7.40(ACPC.2)C0; NWA55AX PRO 7.12(ACSP.1)C0; NWA55AX PTP 7.12(ACSQ.1)C0; NWA55AXE 7.12(ABZL.1)C0; NWA55BE 7.40(ACPH.2)C0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76955 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-76955?** Check whether you run Zyxel IAP500BE, Zyxel NWA110AX, Zyxel NWA110BE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in IAP500BE 7.40(ACPJ.2)C0; NWA110AX 7.12(ABTG.1)C0; NWA110BE 7.40(ACLZ.2)C0; NWA130BE 7.40(ACIL.2)C0; NWA210AX 7.12(ABTD.1)C0; NWA210AXv2 7.40(ACSR.2)C0; NWA210BE 7.40(ACLY.2)C0; NWA220AX-6E 7.12(ACCO.1)C0; NWA240BE 7.40(ACQG.2)C0; NWA30BE 7.40(ACPI.2)C0; NWA50AX 7.12(ABYW.1)C0; NWA50AX PRO 7.12(ACGE.1)C0; NWA50BE 7.40(ACPB.2)C0; NWA50BE MAX 7.40(ACTP.2)C0; NWA50BE PRO 7.40(ACPC.2)C0; NWA55AX PRO 7.12(ACSP.1)C0; NWA55AX PTP 7.12(ACSQ.1)C0; NWA55AXE 7.12(ABZL.1)C0; NWA55BE 7.40(ACPH.2)C0

## Technical details

A buffer overflow exists in the zdp_wtp binary of Zyxel AP firmware, triggered by a LAN-based attacker to escalate privileges to administrator level on vulnerable devices. The vulnerability requires network access (adjacent network) and affects multiple AP models with firmware versions up to and including those listed in the advisory. Patches are available for models within the vendor's support period.

## Affected products

- Zyxel NWA110AX 7.12(ABTG.0)C0 and earlier
- Zyxel IAP500BE 7.40(ACPJ.1)C0 and earlier
- Zyxel NWA110BE 7.40(ACLZ.1)C0 and earlier
- Zyxel NWA130BE 7.40(ACIL.1)C0 and earlier
- Zyxel NWA210AX 7.12(ABTD.0)C0 and earlier
- Zyxel NWA210AXv2 7.40(ACSR.1)C0 and earlier
- Zyxel NWA210BE 7.40(ACLY.1)C0 and earlier
- Zyxel NWA220AX-6E 7.12(ACCO.0)C0 and earlier
- Zyxel NWA240BE 7.40(ACQG.1)C0 and earlier
- Zyxel NWA30BE 7.40(ACPI.1)C0 and earlier
- Zyxel NWA50AX 7.12(ABYW.0)C0 and earlier
- Zyxel NWA50AX PRO 7.12(ACGE.0)C0 and earlier
- Zyxel NWA50BE 7.40(ACPB.1)C0 and earlier
- Zyxel NWA50BE MAX 7.40(ACTP.1)C0 and earlier
- Zyxel NWA50BE PRO 7.40(ACPC.1)C0 and earlier
- Zyxel NWA55AX PRO 7.12(ACSP.0)C0 and earlier
- Zyxel NWA55AX PTP 7.12(ACSQ.0)C0 and earlier
- Zyxel NWA55AXE 7.12(ABZL.0)C0 and earlier
- Zyxel NWA55BE 7.40(ACPH.1)C0 and earlier

## Timeline

- 2026-11-03: disclosed

## References

- [https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026)