Rooted your router lately?
I never really use ISP routers. It was free when re-grading my FTTC to FTTP. Plus it has 2 FXS ports, so could convert VoIP to analogue/PSTN.
But, as I do I check up on what issues it may or may not have. Yep, the firmware has two acknowledged CVE's that affect this firmware and no update currently available. Any more, I wonder? It didn't take long and found another post authentication command injection. Reported it accordingly, but just had to see how far I could go and finally got a reverse shell.
Turns out there is a `supervisor` account with a different password to any other. Managed to change it using the shell and ssh drops me to a standard shell (not zysh) and WebUI offers more options.
Curious find!
If/when Zyxel confirms the flaw, hopefully it'll get assigned a CVE and I'll update accordingly.