An improper restriction of excessive authentication attempts in the web management interface of Zyxel WRE6505 v2 firmware allows an adjacent LAN attacker to repeatedly try login credentials until success. This flaw enables authentication bypass and gives the attacker administrative access, potentially exposing configuration and compromising network control. The weakness is identified as CWE-307.

Devices running Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 are affected. No official patch is documented; the product is listed as end‑of‑life by Zyxel, but no specific fix is referenced.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, but the absence of these metrics does not reduce the real‑world risk. An attacker with local LAN access can brute‑force the web console, obtain administrative privileges, and alter device settings or disable services.