CVE-2026-6374: Zyxel WAH7601 Hard-coded Credentials Flaw

CVE-2026-6374 Overview

CVE-2026-6374 is a hard-coded credentials vulnerability in the Zyxel Networks WAH7601 mobile router. The device firmware contains embedded credentials that an attacker on the adjacent network can recover from an executable and reuse for authenticated access. The issue affects WAH7601 firmware through version 20.07.2026 and is tracked under CWE-798. Successful exploitation exposes sensitive constants and enables unauthorized access to device functionality, compromising confidentiality and integrity of managed traffic and configuration.

Critical Impact
An adjacent-network attacker who extracts the hard-coded credentials can authenticate to the WAH7601 and read sensitive constants, undermining device confidentiality and integrity without any prior privileges.

Affected Products

Zyxel Networks WAH7601 mobile router
All firmware versions up to and including 20.07.2026
Deployments exposing the device management interface to adjacent networks

Discovery Timeline

2026-08-10 - CVE-2026-6374 published to the National Vulnerability Database
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-6374

Vulnerability Analysis

The WAH7601 firmware ships with credentials embedded directly inside an executable binary. Anyone with access to the firmware image or the device filesystem can read these constants using standard binary inspection tools such as strings, binwalk, or a disassembler. Because the credentials are static across devices running the same firmware, a single extraction yields access to every unpatched unit. The attack requires adjacent network access, such as Wi-Fi or a local LAN segment, and some user interaction, but no prior authentication.

The vulnerability aligns with CWE-798: Use of Hard-coded Credentials. Hard-coded credentials cannot be rotated by administrators and typically bypass account lockout, logging, and password policy controls. This makes them a durable foothold once disclosed.

Root Cause

The root cause is the storage of authentication material as literal constants within a shipped binary. Development or service credentials appear to have been compiled into the firmware and never removed before release. See the Siber Güvenlik Advisory TR-26-0799 for coordinated disclosure details.

Attack Vector

An attacker within radio or wired range of the WAH7601 obtains a copy of the firmware from the vendor download portal or by dumping the device flash. Static analysis of the executable reveals the embedded credentials. The attacker then authenticates to the device management interface over the adjacent network and reads configuration values, keys, or other sensitive constants stored on the device. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-6374

Indicators of Compromise

Successful management-interface logins from wireless clients or LAN hosts that are not administrator workstations
Repeated authentication attempts using identical username strings across multiple WAH7601 devices
Configuration reads or exports occurring outside scheduled maintenance windows
New or unexpected sessions to the WAH7601 web or CLI interface immediately after a client joins the wireless network

Detection Strategies

Compare authenticated sessions against an allowlist of administrator source addresses and flag deviations
Inspect firmware images with strings and entropy analysis to confirm the presence of embedded credential constants before deployment
Correlate wireless association events with management-plane logins to identify adjacent-network access patterns

Monitoring Recommendations

Forward WAH7601 authentication, configuration, and session logs to a central SIEM for retention and correlation
Alert on any login using default or vendor-service account names on affected devices
Monitor for unexpected outbound connections from the router that could indicate post-authentication data exfiltration

How to Mitigate CVE-2026-6374

Immediate Actions Required

Inventory all Zyxel WAH7601 units and record their current firmware versions against 20.07.2026
Restrict management-interface access to trusted VLANs and disable remote administration over Wi-Fi where possible
Rotate any shared secrets, Wi-Fi passphrases, or upstream credentials that may have been readable from the device
Apply vendor firmware updates as soon as a fixed release is published in the Siber Güvenlik advisory

Patch Information

At the time of publication, the Siber Güvenlik Advisory TR-26-0799 is the authoritative reference for fix availability. Administrators should track the Zyxel security portal for a firmware release superseding version 20.07.2026 and apply it across all affected units.

Workarounds

Segment WAH7601 devices onto a dedicated management VLAN unreachable from general user networks
Disable Wi-Fi-based administration and require wired access with MAC filtering for configuration tasks
Place the device behind an upstream firewall that blocks inbound access to management ports from untrusted segments
Decommission the device where a compensating control cannot be applied and a patch is not yet available

bash

# Example: block management ports on the upstream firewall
iptables -A FORWARD -d <WAH7601_IP> -p tcp -m multiport --dports 22,23,80,443 -j DROP
iptables -A FORWARD -d <WAH7601_IP> -p udp --dport 161 -j DROP