CVE-2026-6373

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.

This issue affects WAH7601: through 20072026.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
Zyxel Networks	WAH7601	<= 20072026

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0799

Timeline

Published: Aug 10, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-637305.0HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to ma CVE-2026-637317.7HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to ar CVE-2026-637329.99router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh ins CVE-2026-637336.5SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execut CVE-2026-637344.9SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-rol CVE-2026-637358.1SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke e CVE-2026-637364.1SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string CVE-2026-637376.5SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries contai CVE-2026-637384.3SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-re CVE-2026-637397.7SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with ED CVE-2026-63747.3Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affe CVE-2026-637406.5SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied arr