CVE-2025-11846: Zyxel LTE3301-Plus Firmware DoS Vulnerability

CVE-2025-11846 Overview

A null pointer dereference vulnerability exists in the account settings CGI program of multiple Zyxel network devices. This flaw allows an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending specially crafted HTTP requests to vulnerable devices. The vulnerability affects a wide range of Zyxel products including 4G LTE, 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, security routers, and wireless extenders.

Critical Impact

Authenticated administrators can crash affected Zyxel network devices through malicious HTTP requests, potentially disrupting network connectivity for organizations relying on these devices for internet access and network infrastructure.

Affected Products

• Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0
• Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0
• Zyxel LTE3301-Plus, Nebula FWA505/510/515/710 series
• Zyxel DX3300/DX3301/DX4510/DX5401 series
• Zyxel EX2210/EX3300/EX3301/EX3500/EX3501/EX3510/EX3600/EX5401/EX5510/EX5512/EX5601/EX7501/EX7710 series
• Zyxel VMG4005-B50A/B60A, VMG8623-T50B, EMG3525-T50B, EMG5523-T50B
• Zyxel PM3100/PM5100/PM7300/PM7500, PE3301/PE5301, PX3321/PX5301 series
• Zyxel AX7501-B1, GM4100-B0, SCR 50AXE, WE3300-00, WX3401-B1, WX5600-T0, WX5610-B0

Discovery Timeline

• February 24, 2026 - CVE-2025-11846 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2025-11846

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory safety issue that occurs when an application attempts to dereference a pointer that has not been initialized or has been set to null. In this case, the account settings CGI program in affected Zyxel firmware fails to properly validate input before processing HTTP requests, leading to a condition where the program attempts to access memory through a null pointer.

The exploitation requires administrator-level authentication, which limits the attack surface to scenarios where an attacker has already gained administrative access to the device or where administrative credentials have been compromised. While this requirement reduces the immediate risk, insider threats or credential compromise could still enable attackers to leverage this vulnerability for service disruption.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the account settings CGI handler. When processing certain HTTP request parameters, the CGI program fails to check whether critical data structures have been properly allocated or initialized before attempting to access them. This lack of defensive programming allows malformed requests to trigger a null pointer dereference condition, causing the affected service or the entire device to crash.

Attack Vector

The attack is performed remotely over the network by sending a crafted HTTP request to the vulnerable CGI endpoint. The attacker must possess valid administrator credentials to authenticate to the device's web management interface. Once authenticated, the attacker can submit a specially formatted HTTP request to the account settings functionality that triggers the null pointer dereference condition.

The attack flow involves:

1. Attacker authenticates to the Zyxel device with administrator credentials
2. Attacker crafts a malicious HTTP request targeting the account settings CGI program
3. The CGI program processes the malformed request without proper validation
4. A null pointer dereference occurs, causing the service to crash
5. The device becomes temporarily unavailable until manually restarted or automatically recovered

Detection Methods for CVE-2025-11846

Indicators of Compromise

• Unexpected device reboots or service restarts on Zyxel network equipment
• HTTP access logs showing unusual requests to account settings CGI endpoints
• Repeated authentication attempts followed by immediate service disruption
• Administrative session activity from unexpected sources or at unusual times

Detection Strategies

• Monitor web server access logs on Zyxel devices for malformed or anomalous HTTP requests to CGI endpoints
• Implement network-based intrusion detection rules to identify crafted HTTP payloads targeting Zyxel management interfaces
• Track device availability metrics and alert on unexpected service interruptions or reboots
• Review administrative authentication logs for suspicious login patterns preceding device crashes

Monitoring Recommendations

• Configure SNMP traps or syslog forwarding to capture device crash and restart events
• Implement automated availability monitoring for critical Zyxel network infrastructure
• Set up alerts for administrative login activity from unexpected IP addresses or during non-business hours
• Maintain baseline metrics for device uptime to quickly identify anomalous behavior patterns

How to Mitigate CVE-2025-11846

Immediate Actions Required

• Review and update firmware on all affected Zyxel devices to the latest available versions
• Audit administrative credentials and ensure strong, unique passwords are in place
• Restrict management interface access to trusted networks and IP addresses only
• Enable access control lists (ACLs) to limit who can reach device management interfaces
• Consider disabling remote web management if not required for operations

Patch Information

Zyxel has released a security advisory addressing this vulnerability along with related command injection vulnerabilities. Administrators should consult the Zyxel Security Advisory for specific firmware versions that address CVE-2025-11846. Updated firmware should be downloaded only from official Zyxel support channels and verified before installation.

Workarounds

• Restrict administrative access to the web management interface to a dedicated management VLAN or network segment
• Implement firewall rules to block external access to device management ports (typically TCP 80/443)
• Use VPN connections for remote administrative access rather than exposing management interfaces directly
• Enable authentication lockout policies to limit credential compromise risks

# Example: Restrict management access using iptables on a perimeter firewall
# Allow management access only from trusted management subnet
iptables -A FORWARD -p tcp -d <zyxel_device_ip> --dport 80 -s <management_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <zyxel_device_ip> --dport 443 -s <management_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <zyxel_device_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <zyxel_device_ip> --dport 443 -j DROP