What is the CVSS score of CVE-2026-6374?

CVE-2026-6374 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Zyxel WAH7601 are affected by CVE-2026-6374?

The Zyxel WAH7601 mobile Wi-Fi hotspot contains hard-coded credentials allowing network-adjacent attackers to bypass authentication and intercept or manipulate all traffic passing through affected…

How to fix or mitigate CVE-2026-6374?

Within 24 hours, audit your inventory to identify all deployed Zyxel WAH7601 devices and evaluate their connectivity to production systems or sensitive data flows; immediately segregate any high-risk units from trusted network environments. Within 7 days, implement MAC-based wireless access control lists restricting association to authorized devices only, enable device-level logging and monitoring for suspicious authentication attempts, and contact Zyxel Support for patch availability timelines and any interim firmware updates. Within 30 days, initiate a device replacement program for all WAH7601 units prioritizing those in security-sensitive locations, evaluate alternative hotspot vendors with active patch records, and document the transition plan in your asset management system.

Zyxel WAH7601 CVE-2026-6374

EUVD-2026-55619 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-08-10 TR-CERT

GHSA-rx6h-4v89-xfh6

Authentication Bypass Zyxel Wah7601 Zyxel Networks

7.3

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.3 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Hard-coded credential extraction from firmware is entirely attacker-driven and requires no victim interaction, so UI:N is more accurate than the vendor-assigned UI:R; all other metrics align with the provided vector.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 12:53 vuln.today

CVE Published

Aug 10, 2026 - 12:15 cve.org

HIGH 7.3

DescriptionCVE.org

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable.

This issue affects WAH7601: through 20.07.2026.

AnalysisAI

Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the device executable, enabling adjacent-network attackers without any prior privileges to bypass authentication and achieve high-impact confidentiality and integrity compromise. All WAH7601 firmware versions through 20.07.2026 are confirmed affected per TR-CERT advisory TR-26-0799 and NVD. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity characteristic of CWE-798 makes this a credible near-term risk in environments where adjacent access is not tightly controlled.

Technical ContextAI

The Zyxel WAH7601 is a 4G LTE mobile Wi-Fi hotspot (CPE: cpe:2.3:a:zyxel_networks:wah7601:*:*:*:*:*:*:*:*). CWE-798 (Use of Hard-coded Credentials) indicates that static credentials - likely a default authentication secret, private key, or username/password pair - have been compiled directly into the device firmware binary rather than generated per-device or derived at runtime. This class of vulnerability is endemic to consumer and SMB-grade embedded network devices. Attackers who obtain the firmware image (through direct download from vendor servers, firmware extraction from physical hardware, or reverse-engineering tools) can recover these credentials and use them against any unpatched WAH7601 device, regardless of individual device configuration. The CVSS adjacent-vector (AV:A) reflects that the administrative interface targeted is exposed only to clients on the local wireless or wired LAN segment, not to arbitrary internet hosts.

RemediationAI

Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0799 and monitor Zyxel Networks' official security bulletin page for a patched firmware release - no specific fixed firmware version is confirmed in available intelligence, so patch availability cannot be independently verified at time of analysis. As an interim compensating control, restrict adjacent wireless access to WAH7601 administrative interfaces by enabling client isolation or network segmentation so that devices on the hotspot WLAN cannot reach management endpoints; this reduces the pool of potential attackers but does not eliminate the underlying credential exposure. Where possible, disable any administrative services that are not operationally required over the wireless interface. Note that end-users cannot remove or change hard-coded credentials through device settings alone - a vendor firmware update is the only definitive fix. Avoid deploying WAH7601 units in semi-public or multi-tenant wireless environments until a patched firmware is released and applied.