This vulnerability (CVE-2026-7257) affects Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 and is categorized under CWE-922 (Insecure Storage of Sensitive Information). It allows a local attacker with administrator privileges to download and decrypt a backup configuration file, exposing sensitive information stored insecurely within the device. The CVSS 3.1 base score is 4.4, reflecting a medium severity with attack vector local, low attack complexity, and high privileges required. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

The vulnerability could lead to unauthorized disclosure of sensitive information contained in the backup configuration file if an attacker has local administrator access. This compromises confidentiality but does not affect integrity or availability. Because exploitation requires local high privileges, the risk is limited to scenarios where an attacker already has significant access to the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local administrator access to trusted users only and avoid creating or distributing backup configuration files unnecessarily. Monitor Zyxel's official channels for updates or patches addressing this issue.