Buffer overflow in ZyXEL Communications Corp. products - CVE-2026-76955

Vulnerability identifier: #VU159418

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-76955

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the device.

The vulnerability exists due to a boundary error in the zdp_wtp binary. A remote user can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

WAC500H
WAX650S
NWA210AX
WAX610D
WAX510D
NWA110AX
USG LITE 60AX
NWA50AX
WAX630S
NWA55AXE
WAX640S-6E
WAX620D-6E
NWA220AX-6E
NWA90AX
WAX655E
NWA50AX PRO
NWA90AX PRO
WAX300H
NWA55AX PRO
NWA55AX PTP
WBE660S
NWA130BE
WBE530
WBE630S
WBE510D
NWA210BE
NWA110BE
NWA50BE
NWA50BE PRO
NWA90BE
NWA90BE PRO
NWA55BE
NWA30BE
IAP500BE
NWA240BE
WBE665S
FWA7 Root Plus
FWA7 Leaf Plus
NWA210AXv2
NWA50BE MAX
NWA90BE MAX
FWA7 Root

Install updates from vendor's website.

USG LITE 60AX - update to 2.40(ACIP.0)C0
WAX650S - update to 7.12(ABRM.1)C0
NWA210AX - update to 7.12(ABTD.1)C0
WAX610D - update to 7.12(ABTE.1)C0
WAX510D - update to 7.12(ABTF.1)C0
NWA110AX - update to 7.12(ABTG.1)C0
NWA50AX - update to 7.12(ABYW.1)C0
WAX630S - update to 7.12(ABZD.1)C0
NWA55AXE - update to 7.12(ABZL.1)C0
WAX640S-6E - update to 7.12(ACCM.1)C0
WAX620D-6E - update to 7.12(ACCN.1)C0
NWA220AX-6E - update to 7.12(ACCO.1)C0
NWA90AX - update to 7.12(ACCV.1)C0
WAX655E - update to 7.12(ACDO.1)C0
NWA50AX PRO - update to 7.12(ACGE.1)C0
NWA90AX PRO - update to 7.12(ACGF.1)C0
WAX300H - update to 7.12(ACHF.1)C0
NWA55AX PRO - update to 7.12(ACSP.1)C0
NWA55AX PTP - update to 7.12(ACSQ.1)C0
WBE660S - update to 7.40(ACGG.2)C0
NWA130BE - update to 7.40(ACIL.2)C0
WBE530 - update to 7.40(ACLE.2)C0
WBE630S - update to 7.40(ACLW.2)C0
WBE510D - update to 7.40(ACLX.2)C0
NWA210BE - update to 7.40(ACLY.2)C0
NWA110BE - update to 7.40(ACLZ.2)C0
NWA50BE - update to 7.40(ACPB.2)C0
NWA50BE PRO - update to 7.40(ACPC.2)C0
NWA90BE - update to 7.40(ACPD.2)C0
NWA90BE PRO - update to 7.40(ACPE.2)C0
NWA55BE - update to 7.40(ACPH.2)C0
NWA30BE - update to 7.40(ACPI.2)C0
IAP500BE - update to 7.40(ACPJ.2)C0
NWA240BE - update to 7.40(ACQG.2)C0
WBE665S - update to 7.40(ACQJ.2)C0
FWA7 Root Plus - update to 7.40(ACQK.2)C0
FWA7 Leaf Plus - update to 7.40(ACQL.2)C0
NWA210AXv2 - update to 7.40(ACSR.2)C0
NWA50BE MAX - update to 7.40(ACTP.2)C0
NWA90BE MAX - update to 7.40(ACTQ.2)C0
FWA7 Root - update to 7.40(ACUJ.2)C0

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026

• Remote code execution in certain Zyxel APs, FWA7, and security routers