CVE-2026-12984

Executive Summary

CVE-2026-12984 is an Insufficiently Protected Credentials vulnerability (CWE-522) affecting the Zyxel Networks WAH7601 wireless access point. The flaw allows an unauthenticated, remote attacker to retrieve embedded sensitive data — including credentials — from the device's firmware or storage, without requiring any user interaction. With a CVSS score of 8.2, the vulnerability is rated High severity and offers a significant confidentiality impact with limited integrity impact. As of this writing, the vendor has not released a patch, and no public exploit code or proof-of-concept has been confirmed; however, the attack surface is network-exposed by default, making affected units in enterprise environments an immediate risk.

Technical Analysis

The vulnerability is classified as CWE-522: Insufficiently Protected Credentials. This weakness class arises when the product transmits, stores, or otherwise handles authentication credentials (passwords, tokens, API keys, pre-shared secrets) in a manner that does not provide adequate protection against unauthorized access. In the context of a network appliance such as the WAH7601 wireless access point, this typically manifests in one or more of the following architectural weaknesses:

1. Hardcoded or weakly obfuscated credentials baked into firmware images or bootloaders. These are often recoverable through static analysis of the firmware binary, or via debug interfaces left enabled in production builds.
2. Credentials stored in world-readable configuration files or in non-volatile memory partitions that are accessible via unauthenticated endpoints (e.g., diagnostic pages, backup/restore interfaces, or SNMP community strings).
3. Device management interfaces exposing sensitive material — for example, an unauthenticated REST API or web endpoint that discloses configuration blobs containing WPA2/3 passphrases, RADIUS shared secrets, or SNMPv3 authentication keys.

The NVD description explicitly states: "Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data." The phrasing "embedded sensitive data" strongly suggests that the sensitive material (credentials) is stored within the device itself — in firmware, flash storage, or a configuration database — and that an external actor can retrieve it. Critically, the CVSS vector indicates AV:N/AC:L/PR:N/UI:N, meaning the attack is network-based, requires no special conditions, needs no prior authentication, and does not depend on user interaction. The vector also reflects C:H/I:L/A:N — full confidentiality loss but only limited integrity impact and no availability impact.

Attack surface. The WAH7601 is an enterprise-grade wireless access point typically deployed at the edge of corporate networks or in branch offices. Its management interfaces (HTTPS web UI, SNMP, SSH, possibly TR-069 for remote management) are often exposed to the network, and in misconfigured deployments may be reachable from the internet. The vulnerability does not require the attacker to be on the same LAN segment — the network vector implies it can be triggered remotely over any network path.

Technical mechanism (vulnerability-class level). Since the NVD record is sparse, we do not have a specific function name, endpoint, or code path to reference. What is known is that the device fails to adequately protect credential material stored in its local environment. Attackers exploiting this class typically do so by:

• Enumerating known firmware-download endpoints or unauthenticated debug interfaces.
• Sending crafted HTTP/HTTPS requests to configuration disclosure endpoints.
• Leveraging predictable file paths (e.g., /backup.conf, /config.xml) that return configuration archives without authentication.
• Parsing the returned data to extract plaintext or trivially decoded secrets.

The absence of an authentication requirement (PR:N) combined with low attack complexity (AC:L) means a single crafted HTTP request can retrieve sensitive data. The exact retrieval mechanism is not documented; we must describe the attack at the class level rather than inventing specific paths.

Patch status. The CVE metadata indicates a patch confidence of 0/4 — Unpatched. No vendor advisory, no firmware update, and no workaround documentation has been identified from any tracked source. The device is considered vulnerable through firmware builds dated up to July 20, 2026 (the "Affected: through 20072026" date in the NVD record likely corresponds to a firmware build date of 2026-07-20).

Exploitation Scenarios

Because no public PoC exists, the following attack chain is inferred from the vulnerability class (CWE-522) and the CVSS vector. Specific endpoint names are not confirmed.

Step 1 — Reconnaissance / Target Identification. The attacker identifies exposed WAH7601 units via internet-wide scanning (e.g., Shodan, Censys) using HTTP title banners or device fingerprinting patterns. Alternatively, on an internal network, the attacker performs ARP scanning or uses SNMP walking to locate the access point's management IP. The target device is reachable on port 80/443 (management web UI) or 161 (SNMP), or via proprietary management ports.

Step 2 — Triggering the Flaw. Given the vulnerability class, the attacker sends an unauthenticated request to a device endpoint that discloses configuration state or exported settings. In many similar Zyxel products, configuration backup/restore endpoints (e.g., a URL that triggers a .bin or .conf download) historically did not enforce authentication when accessed directly. The attacker either:

• Requests the configuration backup file directly via a predictable URL, or
• Accesses a diagnostic support page that dumps runtime configuration to the client.

Because PR:N (no privileges required) and AC:L (low attack complexity) are set in the CVSS vector, this step requires only a single crafted HTTP request with no session or token.

Step 3 — Payload / Execution Method. No code execution is required. The "payload" is the HTTP request itself — no injection or exploitation of memory corruption is involved. The response body contains the sensitive embedded data. The attacker captures this response, which may include:

• Administrative web UI credentials (hashed or plaintext).
• WPA2/WPA3 PSK (pre-shared key) for the wireless network.
• RADIUS shared secrets for 802.1X authentication.
• SNMPv3 authentication and privacy keys.
• Hardcoded vendor backdoor credentials.

If credentials are stored as unsalted or weakly-hashed digests (common in embedded firmware), the attacker proceeds to offline brute-force or rainbow-table lookup.

Step 4 — Post-Exploitation Impact. Armed with the retrieved credentials, the attacker gains authenticated access to the device management interface (C:H — full confidentiality loss). This enables:

• Full configuration takeover, including adding rogue wireless SSIDs, changing firewall rules, or disabling encryption protocols.
• Lateral movement: the WPA PSK or RADIUS secrets allow the attacker to join the corporate wireless network as a legitimate user, bypassing network segmentation — a classic pivot point into the internal LAN.
• Persistence: attacker sets a new administrative credential, installs a passive sniffing configuration, or enables remote management over the internet.

The I:L (limited integrity) score suggests the attacker can make partial configuration changes but cannot necessarily overwrite the firmware or achieve full system compromise — though access to management credentials typically escalates to full device compromise in practice.

No public exploit code or nuclei template exists for this CVE, and there is no evidence of in-the-wild exploitation as of the CISA KEV (Known Exploited Vulnerabilities) review date.

Impact Assessment

CVSS breakdown (from the provided vector):

• Attack Vector (AV): Network — the device is exploitable remotely.
• Attack Complexity (AC): Low — no special conditions; no race conditions or unusual network states required.
• Privileges Required (PR): None — unauthenticated.
• User Interaction (UI): None — no victim action required.
• Scope (S): Unchanged — the compromise stays within the device's security boundary.
• Confidentiality (C): High — full disclosure of embedded secret material.
• Integrity (I): Low — limited ability to alter data; likely configuration tampering.
• Availability (A): None — no DoS impact.

Business impact. The primary concern is credential disclosure, which undermines the confidentiality of not only the device but also the wireless network it supports. In a branch-office deployment, the WAH7601 often serves as the gateway for IoT devices, guest networks, and legacy wired endpoints. Disclosure of the WPA PSK allows unauthorized parties to decrypt wireless traffic retroactively if the PMK (pairwise master key) is reused, or to join the network and perform lateral movement. Disclosure of RADIUS shared secrets could enable the attacker to impersonate the access point to a RADIUS server or forge Access-Accept messages.

Affected systems. All Zyxel WAH7601 units running firmware up to and including the July 20, 2026 build (201072026). Since the CNA record does not list earlier version exclusions, the entire product line is considered affected.

Blast radius. Medium-to-high. The access point itself is the initial target, but the retrieved credentials provide a foothold into the internal wireless network. In multi-site enterprises, the same default credentials often persist across all WAH7601 deployments, meaning one compromised unit can yield a network-wide credential set.

Detection Guidance

The following detection rules are written for the vulnerability class (unauthenticated retrieval of sensitive configuration data). Since no specific endpoint is documented, the rules target anomalous HTTP/HTTPS response patterns typical of configuration-dump endpoints: unusually large responses, binary content served over HTTP without authentication, mass downloads of backup/config files, and network connections to devices from unexpected hosts.

Sigma Rule

title: Unauthenticated Sensitive Data Retrieval from Zyxel WAH7601
id: 5f6a9c1e-2b3d-4f8a-9c4e-7d2b1a8e4f6c
status: experimental
description: Detects HTTP responses from Zyxel WAH7601 devices that contain configuration backup content or credential patterns without prior authentication, indicating CVE-2026-12984 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12984
author: valtersit.com Threat Intel Team
logsource:
    category: webserver
    product: zeek
    definition: 'Filters on HTTP responses from WAH7601 management interfaces'
detection:
    selection_status:
        http.response.status_code: 200
    selection_patterns:
        http.response.body|contains:
            - 'config.bin'
            - 'sys.conf'
            - 'root_pwd'
            - 'wpa_psk'
            - 'radius_secret'
    filter_known_ips:
        src_ip:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
    condition: selection_status and selection_patterns and not filter_known_ips
level: high
falsepositives:
    - Legitimate configuration backup downloads by administrators from trusted IPs (filtered above)
    - Factory-reset processes that temporarily expose config endpoints
tags:
    - attack.t1005
    - cve.2026.12984

YARA Rule

rule Zyxel_WAH7601_Credential_Disclosure
{
    meta:
        author = "valtersit.com"
        description = "Detects configuration dump payloads or firmware strings associated with CVE-2026-12984 credential exposure on Zyxel WAH7601"
        date = "2026-08-01"
        cve = "CVE-2026-12984"
        severity = "high"
    strings:
        $s1 = "WAH7601" ascii wide
        $s2 = "config.bin" ascii wide
        $s3 = "wlan_psk" ascii wide
        $s4 = "radius_key" ascii wide
        $s5 = "admin_passwd" ascii wide
        $s6 = "sys_credential" ascii wide
        $hex = { 50 4B 03 04 }  // ZIP local file header (config backup format)
    condition:
        ($s1 or $s2) and (any of ($s3,$s4,$s5,$s6) or $hex)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-12984 Zyxel WAH7601 Unauthenticated Config Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:".conf"; http_uri; nocase; content:"WAH7601"; http_header; nocase; sid:202612984; rev:1; classtype:attempted-recon; metadata:cve CVE-2026-12984, target Zyxel WAH7601, confidence medium;)

This rule flags inbound HTTP GET requests to the WAH7601's web interface referencing configuration file extensions, combined with the device banner. Since the exact disclosure endpoint is not documented, this is a heuristic detection.

Elastic Detection

// Identifies successful large HTTP responses from a Zyxel device that
// may represent unauthenticated configuration data retrieval.
network where host.os.type == "linux" and
  destination.port in (80,443) and
  event.category == "network" and
  network.direction == "egress" and
  http.response.status_code == 200 and
  http.response.bytes > 50000 and
  destination.address in ("<WAH7601_MGMT_IP>") // populate with known device IPs

Splunk SPL Query

index=proxy OR index=web index=zeek
| where like(http.response.body, "%config.bin%") 
   OR like(http.response.body, "%wpa_psk%")
   OR like(http.response.body, "%radius_secret%")
| where http.request.method == "GET"
| where http.response.status_code == 200
| where NOT src_ip IN (10.0.0.0/8, 192.168.0.0/16)  // exclude trusted admins
| stats count by src_ip, dest_ip, http.response.bytes, uri
| where count > 1
| table _time, src_ip, dest_ip, uri, http.response.bytes, count

Wazuh OSSEC Rule

<group name="zyxel,web,cve-2026-12984,">
  <rule id="712984" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.conf$|config\.bin|backup</field>
    <field name="status">200</field>
    <description>CVE-2026-12984: Possible unauthenticated config retrieval from Zyxel WAH7601</description>
    <group>authentication_failures,</group>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED.

No vendor patch is available. The following guidance reflects interim risk reduction.

1. Immediate mitigations (compensating controls):

   • Restrict management interfaces (HTTPS, SSH, SNMP) to trusted administrative VLANs only. Use ACLs on upstream firewalls to block access from untrusted networks.
   • If remote management is required, deploy it over a site-to-site VPN or a jump host with strict source-IP allowlisting — do not port-forward the device directly to the internet.
   • Disable SNMP or restrict it to read-only community strings with no default credentials.
   • Monitor device logs and network flows for unusual GET requests to configuration paths or large outbound HTTP responses.
   • Change all wireless PSKs and RADIUS secrets immediately — assume they may have already been exposed in environments where the device is internet-facing.

2. Patch / upgrade steps:

   • Subscribe to Zyxel security advisories for the WAH7601.
   • Check the Zyxel download portal weekly for a firmware release newer than build 2026-07-20.
   • When a patch is released, apply to a staging unit first, then roll out during a maintenance window with a rollback plan.
   • Verify the firmware checksum against the vendor's published hash before installation.

3. Long-term hardening:

   • Replace default credentials on all units immediately (if not already done pre-incident).
   • Implement 802.1X with WPA3-Enterprise rather than PSK-based security; if PSK is unavoidable, use a unique, complex passphrase per device.
   • Rotate RADIUS shared secrets quarterly.
   • Segment wireless networks so that a compromised access point does not provide a path to core corporate resources.
   • Consider replacing the device if the vendor fails to issue a patch within a reasonable period (e.g., 90 days) — this is an unpatched remote credential disclosure flaw.
   • Log a ticket with Zyxel support requesting a patch ETA; reference CVE-2026-12984.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-12984
2. CWE-522 (Insufficiently Protected Credentials): https://cwe.mitre.org/data/definitions/522.html
3. Zyxel Security Advisories Portal: https://www.zyxel.com/global/en/support/security-advisories (Monitor for a future advisory referencing CVE-2026-12984 or firmware build 2026-07-20; no advisory exists as of reporting date.)
4. CVSS Calculator (3.1) for vector verification: https://first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
5. MITRE ATT&CK Technique T1005 — Data from Local System: https://attack.mitre.org/techniques/T1005/

Exploitation in the wild / threat actor campaigns: As of the intelligence date, no confirmed campaigns exist. CISA KEV listing is NO, indicating no known exploitation has been reported to CISA. No public PoC or exploit code has been identified. This status may change rapidly given the device's network-exposed nature; the risk should be treated as active due to the unpatched state and low attack complexity.