The vulnerability is a command injection flaw in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. By sending a specially crafted HTTP request from an adjacent LAN host, an attacker can cause the device to execute arbitrary operating‑system commands. This flaw permits complete takeover of the device’s operating system, providing full control and the ability to pivot to other network assets. The weakness falls under CWE-78, highlighting unsafe handling of user input for system command execution.

Zyxel WRE6505 v2 firmware, specifically version V1.00(ABDV.3)C0. No other versions are listed in the supplied data, so only this configuration is affected.

The CVSS score of 8.8 indicates a high severity exploit that can be achieved relatively easily once the attacker is on the local network. While the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the dependence on LAN proximity means that the attack vector is local rather than internet‑accessible. Organizations with the device on a broad, untrusted LAN face a significant risk: an attacker could gain administrative privileges, install malware, or exfiltrate data. The lack of public exploit indicators suggests that exploitation may require some effort to craft the request, but the high severity and local network attack vector warrant prompt action.