The vulnerability arises from improper handling of SSID encoding in the CGI component of the Zyxel WRE6505 v2 firmware. When an attacker on the local WLAN delivers a specially crafted SSID and an authenticated administrator visits the “AP Select” page, the web management interface crashes, resulting in a denial of service. This flaw falls under CWE‑116 and carries a CVSS score of 4.5, indicating moderate risk to the availability of the device’s management console.

The affected devices are Zyxel WRE6505 v2 routers running firmware version V1.00(ABDV.3)C0. No other versions or products are listed as vulnerable.

Because exploitation requires an adjacent attacker on the same wireless network and an authenticated administrator to trigger the page load, the threat is largely local. The EPSS score is not available, and the flaw is not yet listed in the CISA KEV catalog, suggesting no known widespread exploitation. The CVSS 4.5 indicates a moderate likelihood of causing availability impact, but the need for proximity and authentication reduces the effective risk compared to remote attacks.