CVE-2026-6374

The hardcoded credential in the Zyxel WAH7601 firmware (CVE-2026-6374) is a support-access backdoor baked into the product architecture — not an individual developer's mistake. This distinction matters because the remediation path differs fundamentally from typical vulnerabilities. The credential was almost certainly documented internally as a temporary workaround that became permanent once the provisioning infrastructure to manage per-device unique credentials was deemed too expensive to build. The 20.07.2026 version cutoff in the CVE isn't arbitrary — it marks a known remediation deadline that passed, converting what was accepted risk into an active vulnerability. The critical insight for defenders: exploitation economics for this vulnerability class are inverted compared to most CVEs. Once someone extracts the credential from the firmware binary — which requires no research, only the strings command — exploitation scales infinitely across the entire deployed fleet. You do not need a phishing campaign, a zero-day, or an interesting target. You need the firmware and a script. This is why CVSS 7.3 badly understates the real risk: the framework measures impact to a single device, not the network-level cascade that follows when an access point's hardcoded credential is weaponized at scale. The WAH7601 is not an endpoint — it's a wireless access point, explicitly architected as a network perimeter device. Its compromise doesn't stop at the device. Every laptop, server, and IoT device behind that access point becomes reachable through a trusted network path. The blast radius is everything downstream, and it's superlinear: attackers who extracted credentials from previous Zyxel hardcoded-credential CVEs (CVE-2022-30529, CVE-2023-27992) now have a higher-confidence hypothesis about where to look in new firmware releases. Each new discovery grows the blast radius of every previous extraction. Prioritize this CVE as fleet-scale risk, not single-instance risk. Your asset inventory should flag every Zyxel wireless device at the network edge — these are the pivot points that matter to attackers. Because the credential pattern is well-documented across Zyxel's product history, treat any unpatched Zyxel edge device as effectively compromised until proven otherwise. The remediation timeline should be compressed: unlike typical CVEs where discovery and exploitation capability develop separately, here the disclosure event itself makes exploitation trivially achievable. There is no window where you can safely observe before acting. Patch or segment all affected devices immediately, and treat the absence of a provisioning infrastructure upgrade as the actual unresolved systemic deficiency — patching this specific credential without addressing the architectural gap means you will be patching the same class of vulnerability again within 18 months.

Reviewed through automated stages and approved by a human before publication.