Loading story…
Authorities warned that a serious flaw in the libwebp image library and a critical vulnerability in Zyxel NAS devices could allow attackers to compromise affected systems. The issues were described as severe because successful exploitation could let an attacker execute arbitrary commands, operate the target like a legitimate user, and potentially install additional malicious programs.
The alerts said exploitation could also lead to denial of service, security bypass, privilege escalation, unauthorized modification of stored or displayed data, and theft of confidential information. Organizations using software that depends on libwebp or operating vulnerable Zyxel network-attached storage systems were urged to apply vendor fixes quickly to reduce the risk of system takeover and data exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Traficom published an alert about a serious vulnerability in the libwebp library. The reference describes the potential consequences of exploitation, including denial of service, arbitrary command execution, security bypass, privilege escalation, data modification, and access to confidential information.
Traficom published an alert stating that Zyxel had corrected a critical vulnerability affecting its network-attached storage (NAS) products. The reference indicates the issue could enable severe impacts such as arbitrary command execution and unauthorized access if exploited.
4 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026
Zyxel warned that **CVE-2020-9054** is a critical pre-authentication remote code execution flaw in the `weblogin.cgi` component of certain NAS and firewall products, caused by missing authentication that enables OS command injection. The company said affected systems include NAS devices running firmware **5.21 and earlier** and several UTM, ATP, and VPN firewall releases on **ZLD V4.35 Patch 0 through Patch 2**, and urged customers to install firmware updates immediately or apply workarounds for unsupported devices. Zyxel later reiterated the risk after noting that BotenaGo malware was targeting devices with known CVEs, advising organizations to patch or isolate internet-exposed systems. Palo Alto Networks' Unit 42 reported that a public proof of concept for **CVE-2020-9054** was quickly weaponized to compromise vulnerable Zyxel NAS devices and install a Mirai variant dubbed **Mukashi**. Researchers observed exploitation in the wild beginning March 12, 2020, with attackers using a shell script to fetch architecture-specific bot binaries, erase traces, and enroll devices into a botnet that scans TCP port **23**, brute-forces default credentials, and supports multiple DDoS commands. Unit 42 said the malware communicated with **45[.]84[.]196[.]75** over TCP ports **34834** and **4864**, while also binding locally to TCP port **23448** to prevent multiple infections on the same host.
Aug 15, 2026
The Centre for Cybersecurity Belgium warned of a **critical OS command injection** vulnerability affecting **Zyxel EX3510-B0** routers’ UPnP functionality, tracked as **CVE-2025-13942** (CVSS 3.1 **9.8**, **CWE-78**). Successful exploitation could allow an unauthenticated remote attacker to execute OS commands by sending **specially crafted UPnP SOAP requests**, potentially leading to full device compromise. Zyxel published a security advisory covering this issue and recommended customers apply vendor updates; the Belgian advisory similarly urged **immediate patching** and increased monitoring, noting that updating does not remediate any **prior compromise**. Separately, Zyxel also disclosed a related but distinct command injection issue in a different model—**CVE-2025-13943** in **EX3301-T0**—which requires authentication and is triggered via the log file download function, and should be tracked and remediated as a separate vulnerability from the EX3510-B0 UPnP flaw.
Jun 29, 2026