This vulnerability (CWE-116) in Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 arises from improper encoding or escaping of output in the CGI program. An attacker on the same wireless network can trigger a denial-of-service in the web management interface by leveraging a malformed SSID and convincing an authenticated administrator to access a specific page (“AP Select”). The CVSS 3.1 score is 4.5, reflecting a medium severity with attack vector adjacent network, low attack complexity, and requiring high privileges but no user interaction. No patch or remediation level has been provided by the vendor.

The impact is limited to denial-of-service (DoS) of the web management interface, potentially disrupting administrative access. There is no impact on confidentiality or integrity. The attack requires the attacker to be on the adjacent WLAN and the administrator to be authenticated and visit the affected page.

No official patch or remediation has been announced by Zyxel. Administrators should be cautious about visiting the “AP Select” page when suspicious or malformed SSIDs are present on the WLAN. Monitor vendor advisories for updates regarding fixes or mitigations.