CVE-2026-8508

Improper Authentication in Zyxel WAX650S Captive Portal

Published Aug 4, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.

Analysis

Technical impact

The Zyxel WAX650S firmware contains an improper authentication flaw in the social_login.cgi CGI program. An attacker who can reach the WLAN can exploit this weakness to bypass the captive‑portal authentication mechanism and gain network access. The issue is a classic CWE-287 Improper Authentication vulnerability. Because the attacker can authenticate as any user, the flaw can lead to unauthorized access, potential data exposure, or further lateral movement on the local network.

Affected Systems

Zyxel WAX650S access points running firmware versions through 7.10(ABRM.4)C0. All earlier builds are affected.

Risk and Exploitability

The CVSS score of 6.5 reflects a moderate severity. EPSS data is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local wireless; an adversary on the WLAN can trigger the vulnerable CGI endpoint to bypass authentication. If exploited in a high‑confidentiality environment, the risk of unauthorized network access is significant, though the vulnerability requires proximity to the wireless network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Zyxel

WAX650S firmware

unaffected

Version	Status	Constraints
`<= 7.10(ABRM.4)C0`	affected	—

No data.

Vendor Product Versions

Zyxel

Wax650s Firmware

Version	Status	Scheme	Platform
`[0,7.10(ABRM.4)C0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the WAX650S firmware to the latest available version to eliminate the social_login.cgi authentication flaw.
If a firmware upgrade is not immediately possible, restrict or disable the social_login.cgi endpoint to prevent unauthenticated access.
Segment WLAN traffic and enforce strong captive‑portal authentication, ensuring that clients cannot communicate with the network until credentials are verified.

Generated by OpenCVE AI on August 4, 2026 at 20:35 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.317% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026

History

Aug 4, 2026 9:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Improper Authentication in Zyxel WAX650S Captive Portal

Aug 4, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 4, 2026 3:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zyxel Zyxel wax650s Firmware
Vendors & Products		Zyxel Zyxel wax650s Firmware

Aug 4, 2026 2:30 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.
Weaknesses		CWE-287
References		https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`