This vulnerability (CVE-2026-7255) affects Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 and is classified under CWE-307, which relates to improper restriction of excessive authentication attempts. The flaw allows an attacker with LAN access to repeatedly attempt authentication without sufficient rate limiting or lockout mechanisms, enabling brute-force password attacks and potential authentication bypass. The CVSS 3.1 base score is 6.5, reflecting that the attack vector is adjacent network (AV:A), with low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N, A:N).

An attacker on the same local network can perform brute-force attacks against the web management interface of the affected Zyxel device to gain unauthorized access. Successful exploitation compromises the confidentiality of the device's management interface, potentially allowing unauthorized configuration changes. There is no reported impact on integrity or availability. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit LAN access to the device's management interface to trusted users only. Employ strong, complex passwords to reduce the risk of successful brute-force attempts. Monitor for unusual authentication attempts if possible.