TI-2026-84132 Aliases CVE-2026-76955 GHSA-cc6p-qhcf-9wgq

Zyxel NWA110AX buffer overflow allows LAN privilege escalation

MEDIUM 40CWE-120Published 2026-11-03 · Updated 2026-11-04

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Zyxel NWA110AX firmware through 7.12(ABTG.0)C0 contains a buffer overflow in the zdp_wtp binary, classified as CWE-120. A LAN-based attacker can exploit it to escalate privileges on an affected device.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00252 16th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zyxel	NWA110AX firmware	up to 7.12(ABTG.0)C0	—	No fix listed	CNA

NWA110AX firmware VendorZyxel Affected up to 7.12(ABTG.0)C0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Zyxel NWA110AX firmware.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

2026-11-03 Threatist record created from CVE-2026-76955
2026-11-03 Alias added: GHSA-cc6p-qhcf-9wgq
2026-11-04 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed
2026-11-04 Priority changed: LOW → MEDIUM
2026-11-04 CISA SSVC decision points changed

References

Advisory 1

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026

TI-2023-16198 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
TI-2023-16197 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
TI-2023-13281 OS command injection in Zyxel ZyWALL/USG series firmware KEVCVSS 3.1CRITICAL 9.8
TI-2023-12582 OS command injection in Zyxel NAS326 firmware KEVCVSS 3.1CRITICAL 9.8
TI-2022-12682 OS command injection in Zyxel USG FLEX 100 firmware KEVCVSS 3.1CRITICAL 9.8
TI-2020-17772 Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with… KEVCVSS 3.1CRITICAL 9.8

See all 340 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences