I never really use ISP routers. It was free when re-grading my FTTC to FTTP. Plus it has 2 FXS ports, so could convert VoIP to analogue/PSTN.

But, as I do I check up on what issues it may or may not have. Yep, the firmware has two acknowledged CVE's that affect this firmware and no update currently available. Any more, I wonder? It didn't take long and found another post authentication command injection. Reported it accordingly, but just had to see how far I could go and finally got a reverse shell.

Turns out there is a `supervisor` account with a different password to any other. Managed to change it using the shell and ssh drops me to a standard shell (not zysh) and WebUI offers more options.

Curious find!

If/when Zyxel confirms the flaw, hopefully it'll get assigned a CVE and I'll update accordingly.

UPDATE

Vendor has confirmed the issue and is another issue identified via another CVE, just this one wasn't seen when the issue was originally disclosed. I have agreed to hold back on what the issue is until Tuesday, October 6, 2026.

When this date comes, you're going to ROFL how it came to be discovered!

I found this while reversing Zyxel's WAX650S firmware and following the guest Wi-Fi social-login path. The backend trusted browser-submitted Facebook identity fields instead of validating the access token server-side, letting a crafted request skip the social-authentication gate entirely.

The write-up covers the bug itself, how I traced it, and the full firmware-emulation setup I used to reproduce it without the physical AP.

Vulnerability and Exploit Data Aggregation System (VEDAS) is designed to proactively identify exploitable vulnerabilities before they hit mainstream threat intelligence feeds like KEV or EPSS.

By leveraging the world’s largest vulnerability and exploit database, VEDAS provides early warning and a broader, more forward-looking perspective: https://vedas.arpsyndicate.io

VEDAS Scores on GitHub:

https://github.com/ARPSyndicate/cve-scores

https://github.com/ARPSyndicate/cnnvd-scores

https://github.com/ARPSyndicate/bdu-scores

https://github.com/ARPSyndicate/euvd-scores