A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50…

published 2026-02-24 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-207562

cvss: 4.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

Patch / fix

fixed in 20

zyxel lte3301-plus_firmware 1.00\(abqu.9\)c0
zyxel nebula_fwa505_firmware 1.60\(acko.2\)v0
zyxel nebula_fwa510_firmware 1.60\(acgd.0\)c0
zyxel nebula_fwa515_firmware 1.60\(acpz.0\)v0
zyxel nebula_fwa710_firmware 1.60\(acgc.1\)v0
zyxel ee5301-00_firmware 5.63\(acld.2.1\)c0
zyxel ee3301-00_firmware 5.63\(acmu.2.1\)c0
zyxel dx5401-b1_firmware 5.17\(abyo.7.1\)c0
zyxel dx4510-b1_firmware 5.17\(abyl.10.1\)c0
zyxel dx4510-b0_firmware 5.17\(abyl.10.1\)c0
zyxel dx3301-t0_firmware 5.50\(abvy.7.1\)c0
zyxel dx3300-t1_firmware 5.50\(abvy.7.1\)c0
zyxel dx3300-t0_firmware 5.50\(abvy.7.1\)c0
zyxel nebula_lte3301-plus_firmware 1.18\(acca.6\)v0
zyxel ee6510-10_firmware 5.19\(acjq.4.1\)c0
zyxel emg3525-t50b_firmware 5.50\(abpm.9.7\)c0
zyxel emg5523-t50b_firmware 5.50\(abpm.9.7\)c0
zyxel ex2210-t0_firmware 5.50\(acdi.2.3\)c0
zyxel ex3300-t0_firmware 5.50\(abvy.7.1\)c0
zyxel ex3300-t1_firmware 5.50\(abvy.7.1\)c0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 8 mo ago (2026-02-24)

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Zyxel VMG3625-T50B firmware
Zyxel WX3100-T0 firmware

Classification

Weakness

CWE-476 NULL Pointer Dereference

References

zyxel.com /global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-inject
vendor-advisory

Sources

CVE List CVE-2025-11845
NVD CVE-2025-11845

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary