Affected Vendors
- Zyxel: 1 CVE (High)
- Digi: 3 CVEs
- OpenWrt / DD-WRT: 1 CVE
This Week's Summary
A light week for router vulnerabilities, but with one notable security issue requiring immediate attention. This week saw 5 new CVEs, with a single high-severity flaw affecting Zyxel devices and several kernel-level fixes in common router platforms.
Most Critical: Zyxel Command Injection
CVE-2026-6952 (CVSS 7.2) represents the only high-severity vulnerability this week. Zyxel's AX7501-B1 router is vulnerable to post-authentication command injection through the "LogServer" field in the syslog component. This affects firmware versions through 5.17(ABPC.7.2)C0. While the vulnerability requires authentication, it could allow a compromised or malicious admin account to execute arbitrary commands on the device, potentially leading to full router compromise. Zyxel administrators should check for available firmware updates immediately.
Linux Kernel Fixes
The remaining four CVEs are kernel-level bug fixes affecting Digi serial devices and MIPS-based systems commonly found in router firmware:
- CVE-2026-64333, CVE-2026-64334, and CVE-2026-64335 address stability issues in Digi Acceleport USB serial drivers, including write buffer corruption, hard lockups on disconnect, and broken RX recovery after throttling.
- CVE-2026-64248 fixes an RCU reporting issue in MIPS SMP systems during CPU shutdown.
These are primarily stability and robustness improvements rather than security vulnerabilities, but they may be rolled into future firmware updates for affected router manufacturers using Digi components or MIPS processors.