Deviceways

Wireless access point

ZyXEL NWA50AX

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
MediaTek MT7915 Wi-Fi · MediaTek MT7621AT
Get OpenWrt firmware Release listed · 25.12.6
MediaTek MT7621AT; MediaTek MT7915DAN / MediaTek MT7975DN Wi-Fi · MediaTek MT7621AT
Open hardware record Release listed · 25.12.5
MediaTek MT7976CN Wi-Fi · MediaTek MT7981BA
Open hardware record Release listed · 25.12.5
MediaTek MT7975DN Wi-Fi · MediaTek MT7621AT
Open hardware record Release listed · 25.12.5
Original project github.com

Recorded configuration: 128NAND MB flash; 256 MB RAM

First installation
GUI OEM; U-Boot TFTP + serial recovery
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

ZyXEL NWA50AX PRO — WikiDevi (github.com)

Hardware revision
PRO

Device details

ZyXEL NWA50AX — WikiDevi (github.com)

Hardware revision
(NebulaFlex)

Device details

ZyXEL NWA50AXE — WikiDevi (github.com)

Hardware revision
E (NebulaFlex)

OpenWrt · MediaTek MT7915 Wi-Fi · MediaTek MT7621AT

OpenWrt · MediaTek MT7915 Wi-Fi · MediaTek MT7621AT — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM, U-Boot TFTP + serial recovery
Recovery routes recorded
U-Boot TFTP + serial recovery
Availability recorded by source
Available 2026

Hardware details

Documented hardware

zyxel nwa50ax — device documentation (github.com)ZyXEL NWA50AX — TechInfoDepot (github.com)ZyXEL NWA50AXE — TechInfoDepot (github.com)ZyXEL NWA50AX Pro — TechInfoDepot (github.com)ZyXEL NWA50AX PRO — WikiDevi (github.com)ZyXEL NWA50AX — WikiDevi (github.com)ZyXEL NWA50AXE — WikiDevi (github.com)

Processor
MediaTek MT7621AT
Processor
MediaTek MT7981BA
Wi-Fi chip
MediaTek MT7976CN
Wi-Fi chip
MediaTek MT7915DAN
Wi-Fi chip
MediaTek MT7975DN
Hardware revision
PRO
Hardware revision
(NebulaFlex)
Hardware revision
E (NebulaFlex)

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 7.8 (v3.1)

NWA50AX firmware

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21,…

CVE-2022-26532

Affected firmware
<= 6.25(ABYW.5)
Fix
Fix details in the linked record
Read Zyxel CVE record
Details and sources
CVE updated

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.

CVE published

CVSS 7.2 (v3.1)

NWA50AX firmware

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions…

CVE-2023-6398

Affected firmware
< 6.29(ABYW.4)
Fix
Fix details in the linked record
Read Zyxel CVE record
Details and sources
CVE updated

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1,

USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,

NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.

Security advisory zyxel security advisory for multiple vulnerabilities in firewalls and aps 02 20 2024 — NWA50AX firmware (zyxel.com) ↗
CVE published

CVSS 6.1 (v3.1)

NWA50AX firmware

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50…

CVE-2022-26531

Affected firmware
<= 6.25(ABYW.5)
Fix
Fix details in the linked record
Read Zyxel CVE record
Details and sources
CVE updated

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.

CVE published

CVSS 5.5 (v3.1)

NWA50AX firmware

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37,…

CVE-2023-5797

Affected firmware
6.29(ABYW.2)
Fix
Fix details in the linked record
Read Zyxel CVE record
Details and sources
CVE updated

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access the administrator’s logs on an affected device.

Security advisory zyxel security advisory for multiple vulnerabilities in firewalls and aps — NWA50AX firmware (zyxel.com) ↗
CVE published

CVSS 5.5 (v3.1)

NWA50AX firmware

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37,…

CVE-2023-37925

Affected firmware
6.29(ABYW.2)
Fix
Fix details in the linked record
Read Zyxel CVE record
Details and sources
CVE updated

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device.

Security advisory zyxel security advisory for multiple vulnerabilities in firewalls and aps — NWA50AX firmware (zyxel.com) ↗
Check more security advisories for this device · CVE.org