# CVE-2026-8508: Zyxel WAX650S improper authentication in social_login.cgi

Source: https://junglewise.ai/threats/cve-2026-8508-zyxel-wax650s-improper-authentication-in-social-login-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-8508 · Severity: medium · CVSS 6.5 · Published 2026-08-04

The Zyxel WAX650S is a wireless access point used to provide network connectivity. A flaw in its web authentication mechanism allows attackers on the local wireless network to bypass the captive portal, gaining unauthorized network access without proper credentials. This could enable attackers to access network resources and internal systems intended to be restricted.

Vendors: [Zyxel](https://junglewise.ai/threats/vendors/zyxel).

## Quick answers

**Is CVE-2026-8508 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8508 being exploited in the wild.

**How severe is CVE-2026-8508?** Medium severity, with a CVSS score of 6.5, published 4 August 2026.

**Which products and versions are affected?** Zyxel WAX650S through 7.10(ABRM.4)C0.

**Is there a fix for CVE-2026-8508?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8508 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-8508?** Check whether you run Zyxel WAX650S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability exists in the "social_login.cgi" CGI program in Zyxel WAX650S firmware through version 7.10(ABRM.4)C0. The vulnerability allows attackers on the WLAN to bypass captive portal authentication through improper input validation or authentication checks in the social login handler. No user interaction or prior authentication is required; an attacker simply needs network access to the wireless network. An attacker can exploit this to bypass the access control mechanism and gain unrestricted network access. Patches are available in firmware version 7.12(ABRM.0)C0 and later.

## Affected products

- Zyxel WAX650S through 7.10(ABRM.4)C0

## Timeline

- 2026-08-04: disclosed

## References

- [https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026)

## Related threats

- [Zyxel WAX650S command injection in export-cgi](https://junglewise.ai/threats/cve-2026-6837-zyxel-wax650s-command-injection-in-export-cgi)