CVE-2025-11845: Zyxel LTE3301-Plus Firmware DoS Vulnerability

CVE-2025-11845 Overview

A null pointer dereference vulnerability exists in the certificate downloader CGI program of multiple Zyxel network devices. This security flaw affects the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0, along with numerous other Zyxel products including 4G LTE, 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, security routers, and wireless extenders.

The vulnerability allows an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to the vulnerable CGI endpoint. While exploitation requires administrative access, successful attacks can disrupt network connectivity for all devices relying on the affected router or gateway.

Critical Impact

Authenticated administrators can crash affected Zyxel devices, causing network-wide service disruption for connected clients and downstream infrastructure.

Affected Products

• Zyxel VMG3625-T50B firmware through version 5.50(ABPM.9.6)C0
• Zyxel WX3100-T0 firmware through version 5.50(ABVL.4.8)C0
• Zyxel LTE3301-Plus, Nebula FWA505/510/515/710, DX series, EX series, and 40+ additional product families

Discovery Timeline

• February 24, 2026 - CVE-2025-11845 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2025-11845

Vulnerability Analysis

This vulnerability is classified as CWE-476 (Null Pointer Dereference), occurring when the certificate downloader CGI program attempts to access memory through a null pointer. The vulnerable component fails to properly validate input parameters before processing certificate-related operations, leading to a crash condition when specially crafted requests are received.

The attack can be executed remotely over the network but requires the attacker to first authenticate with administrator-level credentials. Once authenticated, the attacker can send malformed HTTP requests to the certificate downloader CGI endpoint, causing the device to crash and potentially requiring a manual reboot to restore service.

The impact is limited to availability disruption—there is no evidence that this vulnerability can be leveraged for information disclosure or arbitrary code execution. However, in environments where these Zyxel devices serve as primary network gateways, a successful DoS attack could cause significant operational impact.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the certificate downloader CGI program. The code path processes user-supplied data without verifying that required parameters are present and valid. When certain expected values are missing or malformed, the program attempts to dereference a null pointer, resulting in a segmentation fault and process termination.

This type of vulnerability typically occurs when:

• Function return values are not checked before use
• Optional parameters are assumed to be present
• Memory allocation failures are not handled gracefully

Attack Vector

An attacker must first gain administrative access to the Zyxel device's web management interface. This could occur through:

1. Compromised administrator credentials (phishing, credential stuffing, or password reuse)
2. Exploitation of a separate authentication bypass vulnerability
3. Malicious insider with legitimate admin access

Once authenticated, the attacker crafts a malicious HTTP request targeting the certificate downloader CGI endpoint. The request omits or corrupts critical parameters that the CGI program expects, triggering the null pointer dereference condition.

The vulnerability manifests in the certificate downloader CGI program when processing HTTP requests. When a crafted request with missing or malformed certificate-related parameters is received, the program fails to validate the input before attempting to access the associated memory structures. This causes the CGI process to crash, potentially rendering the device's web interface unresponsive and may trigger a full device reboot depending on the device's error handling implementation. See the Zyxel Security Advisory for complete technical details.

Detection Methods for CVE-2025-11845

Indicators of Compromise

• Unexpected device reboots or web interface crashes following HTTP requests to certificate-related CGI endpoints
• Web server error logs showing segmentation faults or null pointer access violations in CGI processes
• Repeated authentication attempts followed by requests to /cgi-bin/ certificate download paths
• Network monitoring alerts indicating sudden loss of connectivity to Zyxel management interfaces

Detection Strategies

• Monitor device logs for abnormal CGI process terminations or crash dumps related to certificate operations
• Implement intrusion detection rules for malformed HTTP requests targeting Zyxel certificate download endpoints
• Deploy behavioral analytics to detect unusual administrative session activity patterns
• Configure SNMP traps or syslog alerts for unexpected device restarts

Monitoring Recommendations

• Enable comprehensive logging on all affected Zyxel devices and forward logs to a centralized SIEM
• Configure uptime monitoring for critical network infrastructure running vulnerable firmware
• Implement network segmentation to limit administrative access to trusted management networks
• Review administrative access logs regularly for anomalous login patterns or geographic origins

How to Mitigate CVE-2025-11845

Immediate Actions Required

• Review the Zyxel Security Advisory for device-specific patched firmware versions
• Inventory all Zyxel devices in your environment and identify those running vulnerable firmware
• Prioritize patching devices exposed to untrusted networks or with weak administrative credentials
• Enforce strong administrator password policies and enable multi-factor authentication where supported

Patch Information

Zyxel has released security updates addressing this vulnerability. Organizations should consult the Zyxel Security Advisory to identify the specific patched firmware version for each affected product model. The advisory covers vulnerabilities in 4G LTE, 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, security routers, and wireless extenders.

Workarounds

• Restrict administrative access to trusted IP addresses using firewall rules or ACLs
• Disable remote web management access if not required for operations
• Implement network segmentation to isolate management interfaces from general user traffic
• Monitor for and block suspicious HTTP requests to certificate-related CGI endpoints at the network perimeter

# Example: Restrict management interface access to trusted subnet
# Configure on upstream firewall or device ACL

# Allow management access only from trusted admin network
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Log dropped connection attempts for monitoring
iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "ZYXEL-MGMT-BLOCKED: "