This vulnerability (CVE-2026-6374) affects Zyxel Networks WAH7601 devices through version 20.07.2026. It is classified under CWE-798, indicating the use of hard-coded credentials within the device's software. The presence of these hard-coded credentials allows unauthorized reading of sensitive constants embedded in the executable, potentially compromising confidentiality and integrity. The CVSS v3.1 base score is 7.3, with attack vector as adjacent network, low attack complexity, no privileges required, user interaction required, and unchanged scope. The vendor has not published any remediation or patch information as of the publication date.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information and compromise of data integrity on affected Zyxel WAH7601 devices. The CVSS vector indicates that an attacker with access to the adjacent network and requiring user interaction could achieve high confidentiality and integrity impact. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit exposure of affected devices to untrusted networks and monitor for unusual activity. No vendor-provided mitigation or temporary fix is currently documented.