CVE-2026-8508

An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.

Affected

Zyxel · WAX650S firmware

CVSS v3.1 ZYXEL

6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-08-04

Proof-of-concept exploits (1)

• minanagehsalalma/zyxel-social-login-bypass-cve-2026-8508/blob/307631bc2a4904e8f59f126f71c…0★ · 2026-08-16

References

• CVE Record
• NVD entry

Related

• CVE-2026-34472
• CVE-2026-34473
• CVE-2026-34474
• CVE-2026-6837