CVE-2026-3871: Zyxel VMG4005-B50B DoS Vulnerability

CVE-2026-3871 Overview

CVE-2026-3871 is a buffer overflow vulnerability [CWE-120] in the Universal Plug and Play (UPnP) DeletePortMapping() command of the Zyxel VMG4005-B50B DSL gateway. The flaw exists in firmware versions through 5.13(ABRL.5.4)C0. An adjacent attacker on the same network segment can send a crafted UPnP request to trigger a temporary denial-of-service (DoS) condition. The condition disrupts the UPnP function of the affected device. No authentication or user interaction is required to exploit the vulnerability.

Critical Impact

An unauthenticated attacker on an adjacent network can disrupt the UPnP service on Zyxel VMG4005-B50B devices, affecting automated port mapping for connected applications.

Affected Products

• Zyxel VMG4005-B50B DSL CPE
• Firmware versions through 5.13(ABRL.5.4)C0
• UPnP service component handling DeletePortMapping() requests

Discovery Timeline

• 2026-06-02 - CVE CVE-2026-3871 published to NVD
• 2026-06-02 - Zyxel publishes security advisory for UPnP buffer overflow vulnerabilities
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-3871

Vulnerability Analysis

The vulnerability resides in the UPnP service implementation of the Zyxel VMG4005-B50B DSL gateway. UPnP exposes a SOAP-based control endpoint that accepts requests such as AddPortMapping(), GetGenericPortMappingEntry(), and DeletePortMapping(). The DeletePortMapping() action accepts parameters including NewRemoteHost, NewExternalPort, and NewProtocol. The vulnerable handler copies one or more of these attacker-supplied fields into a fixed-size stack or heap buffer without enforcing length validation. Sending an oversized value overflows the destination buffer and corrupts adjacent memory or control data. The corruption forces the UPnP daemon to crash, producing a temporary denial-of-service condition.

Root Cause

The root cause is missing bounds checking [CWE-120] on input parameters passed to the DeletePortMapping() SOAP action. The handler trusts the length of attacker-controlled strings received over the UPnP control channel. No length validation or safe string copy routine is applied before writing the data into a fixed-size buffer.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must reside on the same Layer 2 broadcast domain or LAN segment as the gateway. The attacker sends a malformed SOAP request to the UPnP control URL on the device. The oversized parameter triggers the overflow, crashing the UPnP service. The crash interrupts UPnP-dependent functions such as automatic port mapping for VoIP, gaming, and peer-to-peer applications. Confidentiality and integrity are not affected, but service availability is impacted until the daemon restarts.

No verified public proof-of-concept code is available. Refer to the Zyxel Security Advisory on Buffer Overflow for vendor technical details.

Detection Methods for CVE-2026-3871

Indicators of Compromise

• Unexpected restarts or crashes of the UPnP daemon on the gateway.
• SOAP requests to UPnP control endpoints containing unusually large NewRemoteHost, NewExternalPort, or NewProtocol parameter values.
• Loss of automatic port mapping functionality reported by LAN clients.

Detection Strategies

• Inspect LAN traffic destined for TCP ports commonly used by UPnP control endpoints (typically 2828, 5000, or 49152) for malformed SOAP envelopes.
• Alert on DeletePortMapping SOAP actions where parameter lengths exceed expected bounds defined in the UPnP IGD specification.
• Correlate UPnP service crash log entries from gateway syslog output with adjacent client activity.

Monitoring Recommendations

• Forward Zyxel CPE syslog data to a centralized logging platform and alert on UPnP service termination events.
• Baseline normal UPnP request rates per LAN host and flag deviations from that baseline.
• Monitor for repeated source MAC or IP addresses generating malformed UPnP traffic on internal segments.

How to Mitigate CVE-2026-3871

Immediate Actions Required

• Apply the firmware update published by Zyxel for the VMG4005-B50B as referenced in the vendor advisory.
• Disable UPnP on the gateway if the feature is not required by LAN applications.
• Restrict LAN segment access through wired-only policies or strong wireless authentication to limit adjacent attackers.

Patch Information

Zyxel published a security advisory addressing buffer overflow vulnerabilities in the UPnP function of certain DSL Ethernet CPE devices on June 2, 2026. Administrators should obtain the fixed firmware build that supersedes 5.13(ABRL.5.4)C0 from the Zyxel Security Advisory on Buffer Overflow.

Workarounds

• Disable the UPnP service through the gateway administrative interface until the firmware update is applied.
• Segment untrusted devices, including guest Wi-Fi clients, onto an isolated VLAN that cannot reach the UPnP control endpoint.
• Configure firewall rules to drop inbound UPnP SOAP requests originating from untrusted internal hosts.

# Example: disable UPnP via Zyxel CLI (refer to vendor documentation)
configure terminal
no ip upnp
write memory