Sources: National Vulnerability Database, CVE.org, CISA KEV, FIRST EPSS
CVE-2026-76955 Overview
A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.
Critical Impact
Affected Products
- zdp_wtp binary in Zyxel NWA110AX firmware: see the vendor advisory for the exact affected versions
Discovery Timeline
- 2026-11-03: CVE-2026-76955 published to the National Vulnerability Database by security@zyxel.com.tw
- 2026-11-03: last updated in the NVD database
Technical Details for CVE-2026-76955
Vulnerability Analysis
CVE-2026-76955 is a Classic Buffer Overflow weakness (CWE-120: Classic Buffer Overflow) in zdp_wtp binary in Zyxel NWA110AX firmware. Based on its CVSS vector, the flaw needs local or adjacent access, needs no login, and needs no user interaction. Data is copied into a buffer without checking its size.
With a CVSS base score of 8.8, apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Root Cause
The weakness is classified as CWE-120: Classic Buffer Overflow. Data is copied into a buffer without checking its size.
Attack Vector
Based on the CVSS vector, the flaw needs local or adjacent access, needs no login, and needs no user interaction. Attack complexity is low complexity.
No exploitation in the wild is confirmed by CISA at the time of the last update. Check the references below for any vendor or researcher proof of concept.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Detection Methods for CVE-2026-76955
Detection Strategies
- Inventory every instance of zdp_wtp binary in Zyxel NWA110AX firmware and compare the running version with the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Run an authenticated vulnerability scan once your scanner ships a check for this CVE.
Monitoring Recommendations
- Forward zdp_wtp binary in Zyxel NWA110AX firmware application, access and audit logs to your SIEM for retrospective hunting.
- Alert on new processes, configuration changes or outbound connections from the affected service.
- Track the vendor advisory and the CISA KEV catalog for changes in exploitation status.
How to Mitigate CVE-2026-76955
Immediate Actions Required
- Apply the fixed version of zdp_wtp binary in Zyxel NWA110AX firmware named in the vendor advisory.
- Prioritize internet facing and business critical instances first.
- Rescan after the change to confirm the exposure is closed.
Patch Information
Use the fixed version listed in the vendor advisory for zdp_wtp binary in Zyxel NWA110AX firmware.
Workarounds
- If patching must wait, restrict network access to the affected service and place it behind authentication or a web application firewall rule.
CWE References
- CWE-120: Classic Buffer Overflow More CVEs with this weakness
Technical References
This entry is built directly from NVD, CISA KEV and EPSS data. Verify fixed versions in the vendor advisory before you deploy.
Frequently asked questions
Related CVEs
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects azerothcore-wotlk: through v4.0.0.
In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `picName`. When this value is used in `sprintf` without validating variable sizes, it could lead to a buffer overflow vulnerability.
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and processed by `sscanf` without size validation, it could lead to buffer overflow.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2026-76955 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications