CVE-2026-7255
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and bypass authentication.
Risk Assessment
An attacker on the LAN can brute-force the password and gain unauthorized access to the management interface. This may lead to device configuration compromise.
Recommendation
Update Zyxel WRE6505 v2 firmware to a fixed version or replace the device, as the version is unsupported. Restrict management interface access from the LAN.
Other vulnerabilities in Zyxel WRE6505 v2
See all- CVE-2017-7964Critical
Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacking attacks by reconfiguring the built-in dnshijacker process.
- CVE-2026-6058Medium
An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 allows an adjacent attacker on the WLAN to cause a denial-of-service (DoS) condition in the web management interface. The attack requires convincing an authenticated administrator to visit the “AP Select” page while a malformed SSID is present.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and bypass authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS