CVE-2026-7257
Insecure Storage of Sensitive Data in Zyxel WRE6505 v2 Firmware
Publication date: 2026-05-12
Last updated on: 2026-05-12
Assigner: Zyxel Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zyxel | wre6505 | v1.00_abdv.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-922 | The product stores sensitive information without properly limiting read or write access by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability affects Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 and allows a local attacker with administrator privileges to download and decrypt a backup configuration file.
Since the vulnerability requires local administrator access, immediate mitigation steps include restricting administrative access to trusted users only and ensuring that backup configuration files are protected and not accessible to unauthorized users.
Additionally, considering Zyxel's product lifecycle management, it is advisable to check if the device is still supported and to plan migration to a newer, supported product or firmware version that addresses this issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves insecure storage of sensitive information in the configuration file of Zyxel WRE6505 v2 firmware, allowing a local attacker with administrator privileges to download and decrypt backup configuration files. This exposure of sensitive data could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of sensitive information against unauthorized access.
However, the provided context and resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations.
Can you explain this vulnerability to me?
This vulnerability involves insecure storage of sensitive information in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. A local attacker who already has administrator privileges can download and decrypt a backup configuration file, potentially exposing sensitive data.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with administrator access to obtain sensitive information stored in the backup configuration file. This could lead to unauthorized disclosure of confidential data, potentially compromising the security of the device and network.