An insecure storage of sensitive information in the Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 configuration file allows a local attacker with administrator privileges to download and decrypt a backup configuration file. The vulnerability is a CWE‑922 weakness that can expose confidential configuration data, enabling attackers to understand device settings or identify future attack vectors. No code execution or denial of service is achievable from the information provided.

Zyxel WRE6505 v2 firmware, specifically version V1.00(ABDV.3)C0. No other vendor or product variants are mentioned as affected.

The CVSS score of 4.4 indicates a moderate risk level, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate exploitation likelihood. The attack vector is local; an individual must already have administrator privileges on the device. Given the device is no longer supported, a patch or vendor fix is unlikely to be available, which increases the importance of internal mitigations.