Wre6505 V2 Firmware CVE-2026-6058

Exploitation requires the following specific conditions: (1) Attacker must be authenticated as an administrator account on the WRE6505 v2 web interface, OR attacker must be able to convince an authenticated administrator to visit the vulnerable 'AP Select' page while the attacker's malformed SSID is being broadcast. (2) The attacker's wireless network (malformed SSID) must be within Wi-Fi range (adjacent network, AV:A) of the WRE6505 v2. (3) The device must be running firmware version V1.00(ABDV.3)C0 or a similar vulnerable version in the V1.00 series. (4) The 'AP Select' page or SSID scanning feature must be enabled (likely default). Limiting factors: The requirement for authenticated admin access or admin manipulation significantly restricts practical exploitation. The vulnerability does not affect confidentiality (C:N) or integrity (I:N) of the device or network, only availability (A:H) of the management interface. Non-affected scenarios include: administrative accounts with strong password policies and admin training, or networks with wireless access control that prevents the attacker from broadcasting nearby.

CVSS 4.5 reflects moderate real-world risk constrained by multiple limiting factors: attack vector is adjacent-only (AV:A), meaning the attacker must be within Wi-Fi range; privilege level is high (PR:H), requiring an authenticated administrator account; and no user interaction is needed from the attacker, but the administrator must be convinced to visit a specific page. EPSS score not provided; exploitation probability is low because it requires both attacker Wi-Fi proximity and social engineering of an admin. SSVC context: automatable (no user interaction from attacker), but automatable exploitation is moot without network access and admin manipulation. The vulnerability is categorized as unsupported (end-of-life product), meaning no vendor patch is forthcoming - this increases long-term risk for deployed units but indicates Zyxel has deprecated the product line. The information disclosure tag in sources conflicts with the CWE-116/DoS description - verify whether the actual impact is confidentiality loss or availability loss. Real-world priority is LOW to MODERATE: limited to organizations still operating WRE6505 v2 units, requiring adjacent network access, and vulnerable to social engineering of high-privilege accounts.

An attacker positioned within Wi-Fi range of the WRE6505 v2 broadcasts a crafted wireless network with a malformed SSID (e.g., containing null bytes, excessive length, or special encoding sequences). The attacker then social engineers the device administrator via email or phone to visit the 'AP Select' page to 'connect a new network' or 'scan for available SSIDs.' When the administrator navigates to the AP Select page, the CGI program fails to safely encode the attacker's malformed SSID, triggering a buffer overflow, parser crash, or infinite loop that crashes the web management daemon. The administrator loses access to the device's web interface, causing denial-of-service to management functions.