CVE-2026-8508

Published Aug 4, 2026

Last updated 3 months ago

CVSS medium 6.5
Wlan

Overview

Description
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.
Source
security@zyxel.com.tw
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.5
Impact score
3.6
Exploitability score
2.8
Vector string
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity
MEDIUM

Weaknesses

security@zyxel.com.tw
CWE-287

Social media

Hype score
Not currently trending

  1. 🔴 Zyxel cihazlarında Authentication Bypass: CVE-2026-8508 Zyxel'in bazı Access Point, FWA7 ve güvenlik router modellerinde bulunan CVE-2026-8508, captive portal üzerindeki Social/Facebook Login mekanizmasının kimlik doğrulamasını atlamaya izin veriyor. Sorunun kayna

    @ridvanyagli

    3 Sept 2026

    1203 Impressions

    0 Retweets

    7 Likes

    3 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2026-8508: authentication bypass in Zyxel Research identified an authentication bypass in the Zyxel WAX650S portal, tracked as CVE-2026-8508 -> (https://t.co/o2nfkv5jvK). The "/cgi-bin/social_login.cgi" scenario is accessible before authentication and accepts the

    @ptdbugs

    3 Sept 2026

    407 Impressions

    0 Retweets

    5 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  3. 🛡️ Zyxel — más de 35 equipos, entre access points, gateways FWA7 y un router de seguridad, quedaron expuestos a inyección de comandos. Impacto: CVE-2026-6837 permite ejecución de comandos OS post-autenticación en 18 modelos de AP; CVE-2026-8508 permite saltarse la aut

    @Soy_Nube_Negra

    16 Aug 2026

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.•CVE-2026-69517
  2. In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE length fits within the buffer.•CVE-2026-68352
  3. As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20272 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.•CVE-2026-20272
  4. As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20273 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.•CVE-2026-20273
  5. As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20269 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.•CVE-2026-20269

References

Sources include official advisories and independent security research.