This vulnerability (CVE-2026-6374) in Zyxel Networks WAH7601 is classified under CWE-798, indicating the use of hard-coded credentials. It allows unauthorized reading of sensitive constants embedded within the device's executable code. The affected versions include all releases up to and including 20.07.2026. The CVSS v3.1 base score is 7.3, reflecting a high impact on confidentiality and integrity with low attack complexity and no privileges required but user interaction needed. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The vulnerability can lead to unauthorized disclosure of sensitive information due to hard-coded credentials being accessible within the executable. This compromises confidentiality and integrity of the device, potentially allowing attackers to gain unauthorized access or manipulate device behavior. Availability is not impacted. No active exploitation has been observed so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Zyxel Networks communications for updates. No specific temporary mitigations are provided in the available data.