Is CVE-2026-6058 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6058 being exploited in the wild.

How severe is CVE-2026-6058?

Medium severity, with a CVSS score of 4.5, published 21 April 2026.

Which products and versions are affected?

Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0.

Is there a fix for CVE-2026-6058?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6058 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-6058?

Check whether you run Zyxel Wre6505, Zyxel WRE6505 v2 firmware or Zyxel Wre6505 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6058: Zyxel WRE6505 v2 improper encoding DoS in CGI program

CVE-2026-6058 · Severity: medium · CVSS 4.5 · Published 2026-04-21

A vulnerability exists in the Zyxel WRE6505 v2, a wireless range extender used to boost Wi-Fi signals. An attacker near the device could cause the web management interface to crash or become unresponsive by broadcasting a specially crafted Wi-Fi network name (SSID). This would prevent administrators from managing the device settings, though it is important to note that this product is no longer supported by the manufacturer.

Technologies: Zyxel Wre6505, Zyxel Wre6505 Firmware. Vendors: Zyxel.

Quick answers

Is CVE-2026-6058 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6058 being exploited in the wild.
How severe is CVE-2026-6058?: Medium severity, with a CVSS score of 4.5, published 21 April 2026.
Which products and versions are affected?: Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0.
Is there a fix for CVE-2026-6058?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6058 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-6058?: Check whether you run Zyxel Wre6505, Zyxel WRE6505 v2 firmware or Zyxel Wre6505 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper encoding or escaping vulnerability (CWE-116) exists within the CGI program of the Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. An adjacent attacker on the WLAN can trigger a denial-of-service (DoS) condition affecting the web management interface. The attack is executed by broadcasting a malformed SSID; when an authenticated administrator navigates to the 'AP Select' page, the malformed string causes the interface to fail. This vulnerability is currently marked as 'unsupported' by the vendor as the product has reached end-of-life (EOL) status.

Affected products

Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0

Timeline

2026-04-21: disclosed
2026-04-21: advisory

References

https://www.zyxel.com/global/en/support/end-of-life

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.