EUVD-2026-55620
GHSA-3hwg-rq85-p4mc
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Adjacent network vector fits a WiFi hotspot device; unauthenticated access with no integrity or availability impact matches pure information disclosure.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.
This issue affects WAH7601: through 20072026.
AnalysisAI
Sensitive system information exposure in the Zyxel WAH7601 portable 4G LTE mobile hotspot allows unauthenticated adjacent-network attackers to fingerprint the device's web application and firmware stack without any credentials. All firmware versions through 20072026 are affected per CPE data, and the CWE-497 root cause indicates the device's web interface leaks system-identifying data to any party on the adjacent network. No public exploit code or CISA KEV active exploitation has been identified at time of analysis, but the no-authentication, adjacent-network vector makes this trivially reachable by anyone connected to or physically proximate to the hotspot.
Technical ContextAI
The Zyxel WAH7601 is a portable 4G LTE mobile WiFi hotspot device whose embedded web management interface is affected. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a root cause where system-level details - such as firmware version strings, software component identifiers, or build metadata - are returned by the device's web interface to requesters who lack any authorization to receive them. This information enables web application fingerprinting: an attacker learns the precise firmware or software versions in use, which can then be cross-referenced against known CVE databases to identify candidate follow-on exploits. The affected CPE is cpe:2.3:a:zyxel_networks:wah7601:*:*:*:*:*:*:*:*, covering all versions through the firmware dated 20072026. The CVSS vector AV:A confirms the attack surface is constrained to the adjacent network - consistent with the device's nature as a local WiFi access point.
RemediationAI
Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0799 and Zyxel's official support portal for firmware updates addressing this issue; no exact patched firmware version number is confirmed from available data, so the patch status should be treated as unverified until a Zyxel-issued advisory names a specific fix version. As an immediate compensating control, configure the WAH7601 with WPA3 or strong WPA2-PSK using a complex, non-default passphrase to limit which devices can connect to the adjacent network and reach the vulnerable web interface - note this raises the bar for unauthenticated access but does not eliminate the vulnerability for authorized users. Disable the device's web management interface entirely if active administration is not required, accepting the trade-off of losing remote manageability. Restrict the physical environment in which the hotspot is used to reduce the pool of potential adjacent-network attackers.
OS command injection in the Zyxel WAH7601 4G/LTE CPE router lets an attacker inject arbitrary operating-system commands
Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today