CVE-2026-8508Disclosure

CVE-2026-8508: authentication bypass in Zyxel Research identified an authentication bypass in the Zyxel WAX650S portal, tracked as CVE-2026-8508 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-8508). The "/cgi-bin/social_login.cgi" scenario is accessible before authentication and accepts the browser-supplied fields "fb_user", "fb_locale", "fb_age" and "fb_gender" without server-side validation of a Facebook token, OAuth code, or other proof of identity. Exploitation requires no prior privileges or account: an attacker only needs to send a crafted POST request with the "fb_user" field. The device issues an "authtok" cookie and admits the client to a guest session; Zyxel also linked the issue to downstream authorization logic and station replication. The advisory lists 39 affected models of access points and FWA7 devices, as well as the USG LITE 60AX router. Article: https://minanagehsalalma.github.io/zyxel-social-login-bypass-cve-2026-8508/ #dbugs_attacks

🔴 Zyxel cihazlarında Authentication Bypass: CVE-2026-8508 Zyxel'in bazı Access Point, FWA7 ve güvenlik router modellerinde bulunan CVE-2026-8508, captive portal üzerindeki Social/Facebook Login mekanizmasının kimlik doğrulamasını atlamaya izin veriyor. Sorunun kaynağı, /cgi-bin/social_login.cgi endpoint'inin kimlik doğrulama öncesinde erişilebilir olması ve fb_user gibi istemci tarafından gönderilen alanların sunucu tarafında geçerli bir Facebook OAuth token/kimlik kanıtıyla doğrulanmaması. Saldırgan, WLAN üzerinden crafted bir POST isteği göndererek authtok cookie'si alabiliyor ve guest oturumuna kabul edilebiliyor. 📌 CVSS: 6.5 (Medium) 📌 Etkilenen: 39 Zyxel modeli 📌 WAX650S için düzeltilmiş sürüm: 7.12(ABRM.0)C0 ⚠️ Bu bir RCE değil; temel olarak captive portal authentication bypass açığı. Ancak elde edilen oturum bilgisinin downstream authorization ve station enforcement mekanizmalarıyla ilişkili olması nedeniyle etkisi yalnızca login ekranını geçmekle sınırlı olmayabilir. Teknik analiz ve PoC: https://minanagehsalalma.github.io/zyxel-social-login-bypass-cve-2026-8508/

CVE-2026-8508: Trust-Boundary Bypass in Zyxel social_login.cgi Facebook Identity Handling https://minanagehsalalma.github.io/zyxel-social-login-bypass-cve-2026-8508/

🛡️ Zyxel — más de 35 equipos, entre access points, gateways FWA7 y un router de seguridad, quedaron expuestos a inyección de comandos. Impacto: CVE-2026-6837 permite ejecución de comandos OS post-autenticación en 18 modelos de AP; CVE-2026-8508 permite saltarse la autenticación del portal cautivo en más de 35 equipos, incluyendo FWA7 y el USG LITE 60AX. Estado: parches ya disponibles para la mayoría de modelos, salvo el WAC500H que requiere hotfix bajo solicitud, y el USG LITE 60AX que recibe su parche recién en septiembre. Acción hoy: 1. Verifica el modelo y versión de firmware exacto contra el listado de Zyxel. 2. Actualiza a firmware 7.12 o 7.40 según corresponda al equipo. 3. Si tienes un USG LITE 60AX, restringe acceso administrativo mientras llega el parche de septiembre. Tienes inventario actualizado de qué firmware corre cada AP de tu red ahora mismo? Sigue a @smarteck_cl si te sirve este tipo de análisis. #Zyxel #CVE #Networking https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026

🚨 CVE-2026-8508 — Zyxel WAX650S Captive Portal Auth Bypass A flaw in social_login.cgi lets an attacker already on the WLAN bypass captive portal authentication entirely — no valid login needed. CVSS 6.5 (Medium), but real-world risk is higher on shared networks (hotels, offices, schools). Also affects: NWA, WAX, WBE, FWA7 & Security Router series — not just the WAX650S. Fix: Update to firmware 7.12(ABRM.0)C0+

Attention, elevated activities detected targeting Zyxel WAX650S (CVE-2026-8508) https://vuldb.com/vuln/385743/cti

CVE-2026-8508: Το Zyxel WAX650S εκθέτει το captive portal σε παράκαμψη πιστοποίησης https://secn.ws/pNIQSW