---
id: "CVE-2026-76955"
kind: "vulnerability"
aliases: ["CVE-2026-76955"]
title: "Zyxel NWA110AX access point: buffer overflow lets LAN attacker escalate privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NWA110AX", "fixed": ["7.12(ABTG.1)C0"], "affected": "<= 7.12(ABTG.0)C0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firmware", "infrastructure", "lan-adjacent", "nwa110ax", "wifi-access-point", "zyxel"]
not_affected_if: ["isolated-network", "newer-firmware"]
published_at: "2026-11-03T02:16:53+00:00"
first_seen_at: "2026-11-03T02:47:45+00:00"
updated_at: "2026-11-03T02:51:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76955", "first_seen_at": "2026-11-03T02:47:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T02:51:34+00:00"}]
---

# Zyxel NWA110AX access point: buffer overflow lets LAN attacker escalate privileges

The zdp_wtp binary in Zyxel NWA110AX firmware through 7.12(ABTG.0)C0 has a buffer overflow. A LAN-based attacker can use it to escalate privileges on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NWA110AX affected <= 7.12(ABTG.0)C0 fixed 7.12(ABTG.1)C0

## How to check

Check the firmware version in the NWA110AX web admin page or CLI. 7.12(ABTG.0)C0 or earlier is vulnerable; 7.12(ABTG.1)C0 is the patched build. Also check other Zyxel APs, FWA7 and USG LITE 60AX against the model table in the advisory; those are affected too.

## Fix

Update NWA110AX firmware to 7.12(ABTG.1)C0 (Zyxel advisory, 2026-11-03).

## Timeline

- 2026-11-03T02:47:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76955
- 2026-11-03T02:51:34+00:00 analyst — Read Zyxel advisory (11-03-2026): fix 7.12(ABTG.1)C0 for NWA110AX. Auth requirement not stated by vendor; not verified (third-party NVD vector says AV:A/PR:N). No exploitation/PoC found. Did not check X.

## Documents

- [advisory] Zyxel security advisory for buffer overflow vulnerability in certain APs, FWA7, and Security Routers https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026

## From the sources

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_