CVE-2026-7255 — The Web Management Interface Of Zyxel WRE6505 Vulnerability

title: CVE-2026-7255 - Zyxel WRE6505 Web Management Brute Force Attempts
id: scw-2026-05-12-ai-1
status: experimental
level: high
description: |
  Detects multiple failed authentication attempts (HTTP 401 or 403 status codes) originating from an adjacent network IP address (assuming a common LAN subnet) targeting the Zyxel WRE6505 web management interface. This is indicative of an attacker attempting to brute-force credentials as described in CVE-2026-7255.
author: SCW Feed Engine (AI-generated)
date: 2026-05-12
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7255/
tags:
  - attack.credential_access
  - attack.t1110
logsource:
    category: authentication
detection:
  selection:
      src_ip:
          - '192.168.1.0/24' 
      sc-status:
          - '401'
          - '403'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse