CVE-2025-11847: Zyxel LTE3301-Plus Firmware DoS Vulnerability

CVE-2025-11847 Overview

A null pointer dereference vulnerability exists in the IP settings CGI program of multiple Zyxel network devices, including the VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0. This vulnerability could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to the affected device.

Critical Impact

Authenticated administrators can crash affected Zyxel network equipment, causing service disruption for all connected users and potentially requiring physical device intervention to restore connectivity.

Affected Products

• Zyxel VMG3625-T50B (firmware through 5.50(ABPM.9.6)C0)
• Zyxel WX3100-T0 (firmware through 5.50(ABVL.4.8)C0)
• Zyxel LTE3301-Plus, Nebula FWA505/510/515/710, DX3300/DX3301/DX4510/DX5401 series
• Zyxel EX series (EX2210-T0, EX3300, EX3301, EX3500, EX3501, EX3510, EX3600, EX5401, EX5510, EX5512, EX5601, EX7501, EX7710)
• Zyxel PMG, PE, PM, PX, WX, VMG, EMG, SCR, AX, GM, and WE series network devices

Discovery Timeline

• February 24, 2026 - CVE-2025-11847 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2025-11847

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory safety issue that occurs when an application attempts to use a pointer that has a value of NULL (zero) for an operation that requires a valid memory address. In the context of Zyxel network devices, this flaw exists within the IP settings CGI program that handles HTTP requests for network configuration.

When an authenticated administrator sends a specially crafted HTTP request to the vulnerable CGI endpoint, the firmware fails to properly validate input parameters before dereferencing a pointer. This causes the application to attempt to access memory at address zero, which on most systems results in an immediate crash of the affected process or the entire device.

The practical impact of this vulnerability is denial of service. While the vulnerability requires administrator-level authentication to exploit, malicious insiders, compromised admin accounts, or attackers who have gained administrative credentials through other means could leverage this flaw to disrupt network connectivity for all users relying on the affected device.

Root Cause

The root cause of CVE-2025-11847 is improper input validation in the IP settings CGI handler. The firmware code fails to verify that required parameters are present and valid before dereferencing associated pointers. When crafted input omits or malforms expected values, the code path results in a NULL pointer being used for memory operations, triggering an unhandled exception that crashes the device.

This type of vulnerability typically arises from:

• Missing null checks before pointer dereferencing operations
• Incomplete error handling when parsing HTTP request parameters
• Assumptions that input data will always be well-formed when received from authenticated sessions

Attack Vector

The attack vector for this vulnerability is network-based, targeting the web management interface of affected Zyxel devices. An attacker must first authenticate to the device with administrator credentials, then send a malformed HTTP request to the IP settings CGI endpoint.

The exploitation process follows this pattern:

1. Attacker gains access to administrator credentials through credential theft, brute force, or insider access
2. Attacker authenticates to the device's web management interface
3. Attacker crafts a malicious HTTP request targeting the vulnerable IP settings CGI program with missing or malformed parameters
4. The CGI handler processes the request without proper validation
5. A null pointer dereference occurs, causing the device to crash
6. Network connectivity is disrupted until the device reboots or is manually recovered

While no public exploit code is currently available, the attack methodology is straightforward for anyone with administrative access. The vulnerability does not allow code execution or data exfiltration—its impact is limited to service disruption.

Detection Methods for CVE-2025-11847

Indicators of Compromise

• Unexpected device reboots or crashes without scheduled maintenance
• Anomalous HTTP requests to IP settings CGI endpoints in web server logs
• Repeated authentication attempts followed by device unavailability
• Administrative sessions accessing network configuration pages from unusual IP addresses

Detection Strategies

• Monitor web management interface logs for malformed HTTP requests to CGI endpoints
• Implement network intrusion detection rules to identify unusual patterns of administrative access followed by device failures
• Deploy SNMP or syslog monitoring to track unexpected device reboot events
• Correlate authentication logs with device availability metrics to identify potential exploitation attempts

Monitoring Recommendations

• Enable verbose logging on affected Zyxel devices to capture detailed HTTP request information
• Configure alerting for device connectivity failures or unexpected restarts
• Implement centralized log collection from all affected network devices
• Establish baseline device behavior to facilitate anomaly detection

How to Mitigate CVE-2025-11847

Immediate Actions Required

• Review all administrator account credentials and ensure strong, unique passwords are in use
• Restrict web management interface access to trusted management networks only
• Audit administrative access logs for any suspicious activity
• Consider disabling remote web management if not operationally required

Patch Information

Zyxel has released a security advisory addressing this vulnerability along with related command injection vulnerabilities. Organizations should consult the Zyxel Security Advisory for specific firmware versions that address CVE-2025-11847.

Administrators should:

1. Identify all affected Zyxel devices in their environment
2. Download updated firmware from Zyxel's support portal
3. Schedule maintenance windows to apply firmware updates
4. Verify successful patching by checking firmware version after update

Workarounds

• Restrict administrative access to the web management interface using firewall rules or ACLs
• Implement network segmentation to isolate management interfaces from general user traffic
• Enable two-factor authentication for administrative access if supported by the device
• Monitor for and immediately investigate any unexpected device behavior or crashes

# Example: Restrict management interface access using iptables on upstream firewall
# Allow management access only from trusted admin subnet
iptables -A FORWARD -d <zyxel_device_ip> -p tcp --dport 80 -s <trusted_admin_subnet> -j ACCEPT
iptables -A FORWARD -d <zyxel_device_ip> -p tcp --dport 443 -s <trusted_admin_subnet> -j ACCEPT
iptables -A FORWARD -d <zyxel_device_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <zyxel_device_ip> -p tcp --dport 443 -j DROP