Zyxel WAH7601 CVE-2026-12984

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated remote exploitation with no special conditions required beyond network reachability of the WAH7601 device. Exploitation does not require any prior authentication, specific non-default configuration, or user interaction. The primary limiting factor is network reachability: if the management interface is only accessible to clients connected to the WAH7601's own Wi-Fi hotspot, exploiting parties must first associate with the device's wireless network (which may itself use a known or weak PSK). If WAN-side or internet-facing management is enabled, exploitation is possible from arbitrary remote locations. All firmware versions through 20072026 are stated as affected with no version-specific carve-outs.

The CVSS 8.2 score is supported by the AV:N/AC:L/PR:N/UI:N vector, indicating low-complexity unauthenticated network exploitation - the highest-risk combination for remote attack surface. The confidentiality impact is rated High (C:H), consistent with full credential retrieval, while Integrity is Low (I:L), suggesting indirect downstream impact such as credential reuse or configuration manipulation after exfiltration. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no known public proof-of-concept, which reduces immediate exploitation likelihood despite the high CVSS. The flaw was reported by USOM (Turkey's national CERT), and the sole reference points to a Turkish cybersecurity bulletin, suggesting limited public disclosure scope at this time. Real-world risk depends heavily on whether the WAH7601 management interface is reachable over the internet or only from associated Wi-Fi clients - if scoped to local clients only, AV:N may overstate the exposure. No SSVC decision framework data was provided; exploitation status is unconfirmed, and automatable exploitation cannot be assessed without a POC. Overall, this is a credible high-severity flaw on a consumer/SMB networking device that warrants prioritization, as stolen credentials from such devices can enable persistent access, traffic interception, or further lateral movement.

An attacker within network range of the WAH7601 - or with access to any exposed management port - sends a crafted unauthenticated HTTP request to the device's management interface to retrieve stored credentials such as the admin password or ISP authentication tokens. No proof-of-concept is publicly known at time of analysis, but the low attack complexity and absence of authentication requirements mean exploitation would be straightforward once the specific endpoint is identified. Retrieved credentials could then be used to fully control the device, intercept traffic, or authenticate to upstream services.