CVE-2026-7255

Brute‑Force Authentication Vulnerability in Zyxel WRE6505 v2 Firmware

View on CVE.org
Published May 12, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and bypass authentication.

Analysis

AI-generated

Technical impact

An improper restriction of excessive authentication attempts in the web management interface of Zyxel WRE6505 v2 firmware allows an adjacent LAN attacker to repeatedly try login credentials until success. This flaw enables authentication bypass and gives the attacker administrative access, potentially exposing configuration and compromising network control. The weakness is identified as CWE-307.

Affected Systems

Devices running Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 are affected. No official patch is documented; the product is listed as end‑of‑life by Zyxel, but no specific fix is referenced.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, but the absence of these metrics does not reduce the real‑world risk. An attacker with local LAN access can brute‑force the web console, obtain administrative privileges, and alter device settings or disable services.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict LAN access to the management interface using firewall rules or VLAN isolation so that only trusted hosts can reach the management port.
  • Enforce strong, unique passwords on the device and change any default credentials immediately.
  • If the Web Management feature is not required, disable it, or move management to a secure remote access method such as SSH with key authentication.

Generated by OpenCVE AI on May 12, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Zyxel wre6505
CPEs cpe:2.3:h:zyxel:wre6505:v2:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wre6505_firmware:v1.00\(abdv.3\)c0:*:*:*:*:*:*:*
Vendors & Products Zyxel wre6505
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Zyxel
Zyxel wre6505 Firmware
Vendors & Products Zyxel
Zyxel wre6505 Firmware
Type Values Removed Values Added
Title Brute‑Force Authentication Vulnerability in Zyxel WRE6505 v2 Firmware
Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and bypass authentication.
Weaknesses CWE-307
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts

Sources

Status
PUBLISHED
Assigner
Zyxel
Published
Updated
May 12, 2026, 12:50 PM
Reserved
Apr 28, 2026, 2:06 AM

View source JSON

Updated
May 12, 2026, 12:50 PM

JSON

Status
Analyzed
Published
May 12, 2026, 4:16 AM
Modified
Oct 26, 2026, 6:10 PM

View source JSON

No data.

Updated
May 12, 2026, 8:45 AM

JSON