Executive brief
The Zyxel WAH7601 is a wireless access point device used to provide network connectivity in business environments. A vulnerability in how the device stores sensitive credentials allows attackers to extract embedded authentication data, potentially leading to unauthorized access to the device and the networks it manages.
Technical details
The WAH7601 stores sensitive credentials (such as authentication tokens or configuration passwords) in an insufficiently protected manner within the device firmware or configuration files. An attacker with local access or via network exploitation of an adjacent vulnerability can retrieve and decode these embedded credentials. The specific attack vector requires either direct filesystem access or a complementary remote exploitation path. Once credentials are obtained, an attacker can assume administrative control of the access point and potentially pivot to compromise connected networks.
Affected products
- Zyxel Networks WAH7601 through 20072026
Timeline
- 2026-08-10: disclosed