CVE-2026-6373

Deferred Deferred - Pending Action

Web Application Fingerprinting in Zyxel WAH7601

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-26

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-6373

EUVD

EUVD-2026-55620

Affected Vendors & Products

Vendor	Product	Version / Range
zyxel_networks	wah7601	to 20072026 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

This vulnerability involves the exposure of sensitive system information to unauthorized parties in Zyxel Networks WAH7601 devices. It specifically allows for Web Application Fingerprinting, which could enable attackers to identify system details without proper authorization.

Detection Guidance

This vulnerability involves exposure of sensitive system information through web application fingerprinting. To detect it, monitor network traffic for unusual fingerprinting attempts targeting WAH7601 devices. Check for HTTP requests with specific headers or patterns that could reveal system details. Inspect logs for unauthorized access attempts or unusual data exfiltration activities.

Impact Analysis

An attacker could exploit this to gather sensitive system information, potentially leading to further attacks or unauthorized access. The impact includes compromised confidentiality of system data.

Compliance Impact

The vulnerability exposes sensitive system information, which could lead to unauthorized access to data. This may violate GDPR's data protection principles and HIPAA's security rules if the affected system handles personal or health data.

Mitigation Strategies

Update the Zyxel WAH7601 firmware to the latest version to address the vulnerability. Disable unnecessary network services and restrict access to the device's web interface to trusted networks only.

Hi! I’m here to help you understand CVE-2026-6373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70