Zyxel AX7501-B1 Syslog Command Injection (CVE-2026-6952)

CVE-2026-6952 is a post-authentication command injection flaw in the syslog component of several Zyxel DSL/Ethernet CPE, Fiber ONT and Wireless Extender products. Zyxel's advisory says the flaw sits in the device's "LogServer" field and lets an authenticated attacker with administrator privileges run operating system commands on the device.

The CVE record's structured affected-product field names only the AX7501-B1 fiber ONT, firmware 5.17(ABPC.7.2)C0 and earlier. Zyxel's advisory text describes the same syslog flaw across 42 named models in three product families, all under this one CVE id.

Zyxel's advisory says WAN access is off by default on these devices. Exploitation therefore needs an attacker who already holds a compromised administrator password. CWE classifies the flaw as CWE-78, OS command injection.

How the Score Reads

The CVE record scores CVE-2026-6952 CVSS 3.1 7.2 High, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. See our CVSS entry for how to read the vector. No CVSS 4.0 score appears in the record.

Is There a Working Exploit for CVE-2026-6952 on the AX7501-B1?

Brandefense Blackhole recorded two telegram mentions of CVE-2026-6952, both dated 21 July 2026, the day Zyxel's advisory first published. Our GitHub search for this CVE found one public repository, created 8 November 2026. Its own documentation says it tested a different Zyxel model under the same advisory. It states plainly that it did not test the AX7501-B1, the model this CVE record names.

As of CISA catalog version 2026.11.06, CVE-2026-6952 is not in the Known Exploited Vulnerabilities catalog. See our KEV glossary entry for how the catalog works.

Zyxel's advisory lists 42 affected models across three product families: 29 DSL/Ethernet CPE devices, 10 fiber ONTs and 3 wireless extenders. Each model has its own patched firmware version. The table below lists every model in the order the advisory gives, grouped by those three categories.

Only the AX7501-B1 row above matches the model name in the CVE record's own affected-product field. The record does not name the other 41 models individually, though Zyxel's advisory covers them under the same CVE id. Thanks to William Honnér for reporting the issue, per the advisory's acknowledgment.