The vulnerability identified as CVE-2026-12984 in Zyxel Networks WAH7601 devices is classified under CWE-522 (Insufficiently Protected Credentials). It allows unauthorized retrieval of embedded sensitive data due to inadequate protection of credentials within the device. The CVSS 3.1 base score is 8.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but limited integrity impact. The affected versions include all WAH7601 firmware versions up to and including 20072026. No vendor advisory or patch information is currently available, and no active exploitation has been reported.

An attacker can remotely retrieve sensitive embedded credentials from the affected Zyxel WAH7601 devices without authentication, potentially compromising confidentiality. The integrity impact is limited, and availability is not affected. This could lead to unauthorized access or further attacks leveraging the exposed credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Zyxel's advisories for updates. No vendor-provided mitigation or workaround is currently documented.