This vulnerability (CVE-2026-12984) in Zyxel Networks WAH7601 is classified as CWE-522 (Insufficiently Protected Credentials). It allows an attacker to retrieve embedded sensitive data due to inadequate protection of credentials within the device. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, causing a high confidentiality impact but limited integrity and no availability impact. The affected versions include all versions up to 20072026. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can remotely retrieve sensitive embedded credentials from the affected Zyxel WAH7601 devices, potentially leading to unauthorized access or further compromise. The confidentiality of sensitive data is highly impacted, while integrity is only slightly affected and availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Zyxel Networks communications for updates. Until a patch is available, restricting network access to the device and minimizing exposure to untrusted networks may reduce risk.