This CVE breaks from the typical credential-theft narrative. The WAH7601 mobile LTE hotspot doesn't leak credentials through interception or injection—it stores them in a retrievable format within firmware or configuration files. That's a fundamentally different vulnerability class: an attacker with local access or minimal authentication can extract embedded admin credentials, WiFi keys, SIM provisioning data, or certificates directly from the device, not intercept them in transit.
The CVSS 8.2 score obscures the real problem: mobile hotspots are forgotten infrastructure. They sit outside conventional asset registers, rarely receive scheduled patches, and often ship with factory-default configurations. If embedded credentials are extractable, an attacker who compromises the device gains a foothold that may survive factory resets—device identity can effectively be cloned.
The critical technical questions you need answered: Are credentials stored in plaintext NOR/NAND flash (dumped via UART/JTAG), or in an obfuscated configuration blob (requiring authenticated API access)? The answer determines whether physical access or LAN adjacency is the actual precondition. If the WAH7601 supports TR-069 or Zyxel's cloud management platform, remote exploitation may be possible without physical touch—and the CVSS rating likely understates exposure for enterprise-managed units.
The version cutoff at 20072026 is suspicious. It suggests a date-based versioning scheme where the fix landed in an internal build rather than a clearly documented security release. Push Zyxel to confirm: has the provisioning workflow been redesigned, or was this just a symptom-level patch? If debug paths like UART/JTAG remain accessible in the firmware, or if provisioning credentials are still embedded but renamed, the vulnerability class persists.
Operational priority hinges on deployment context. Enterprise devices under MDM or carrier fleet management may have a patching channel; unmanaged units in executive travel bags represent permanent exposure. When a compromised hotspot bridges a corporate network, it's no longer just credential theft—it's a persistent, firmware-level node that can intercept or relay traffic while appearing legitimate. Assume full compromise, revoke everything the device could access, and replace the hardware. This is the same vulnerability pattern the industry largely addressed in early-2000s DSL modems but never properly closed for the mobile hotspot class.