CVE-2026-6952: Command Injection in Zyxel AX7501-B1 Syslog

CVE-2026-6952 is a post-authentication command injection vulnerability in the syslog component of Zyxel AX7501-B1 routers. An authenticated attacker with administrative privileges can inject OS commands through the 'LogServer' field, gaining complete device control. Zyxel AX7501-B1 routers are critical infrastructure components in enterprises, internet service providers, and telecommunications networks, making this flaw a concrete threat to network administrators.

The vulnerability carries a CVSS score of 7.2 with 'high' rating according to the National Vulnerability Database. Although it requires pre-existing administrative credentials, it represents a critical escalation vector for attackers who have compromised management credentials. A recent GitHub signal (November 8, 2026) confirms the existence of a reproducible offline proof-of-concept with vendor advisory and model-by-model evidence publicly available. The official advisory has been circulated since July 21, 2026.

Administrators must first contact Zyxel to verify the availability of updated firmware for their models, as all versions through 5.17(ABPC.7.2)C0 remain vulnerable. Short-term, restrict administrative access to these devices strictly to those with operational need. Actively monitor the LogServer field in syslog records to detect injection attempts. Consider network segmentation to geographically or logically isolate these routers, and conduct a comprehensive inventory of all AX7501-B1 devices in your infrastructure to manage remediation efforts effectively.