CVE-2025-11845

Published: Feb 24, 2026Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

Affected (55)

Products: Zyxel: Lte3301 Plus Firmware, Nebula Fwa505 Firmware, Nebula Fwa510 Firmware, Nebula Fwa515 Firmware, Nebula Fwa710 Firmware, Ee5301 00 Firmware, Ee3301 00 Firmware, Dx5401 B1 Firmware, Dx4510 B1 Firmware, Dx4510 B0 Firmware, Dx3301 T0 Firmware, Dx3300 T1 Firmware, Dx3300 T0 Firmware, Nebula Lte3301 Plus Firmware, Ee6510 10 Firmware, Emg3525 T50b Firmware, Emg5523 T50b Firmware, Ex2210 T0 Firmware, Ex3300 T0 Firmware, Ex3300 T1 Firmware, Ex3301 T0 Firmware, Ex3500 T0 Firmware, Ex3501 T0 Firmware, Ex3510 B0 Firmware, Ex3510 B1 Firmware, Ex3600 T0 Firmware, Ex5401 B1 Firmware, Ex5510 B0 Firmware, Ex5512 T0 Firmware, Ex5601 T0 Firmware, Ex5601 T1 Firmware, Ex7501 B0 Firmware, Ex7710 B0 Firmware, Gm4100 B0 Firmware, Pm7500 00 Firmware, Vmg3625 T50b Firmware, Vmg4005 B50a Firmware, Vmg4005 B60a Firmware, Ax7501 B1 Firmware, Pe3301 00 Firmware, Pe5301 01 Firmware, Pm3100 T0 Firmware, Pm5100 T0 Firmware, Pm5100 T1 Firmware, Pm7300 T0 Firmware, Px3321 T1 Firmware, Px5301 T0 Firmware, Scr 50axe Firmware, Vmg8623 T50b Firmware, We3300 00 Firmware, Wx3100 T0 Firmware, Wx3401 B1 Firmware, Wx5600 T0 Firmware, Wx5610 B0 Firmware

Zyxel

54 products

Lte3301 Plus Firmware

Nebula Fwa505 Firmware

Nebula Fwa510 Firmware

Nebula Fwa515 Firmware

Nebula Fwa710 Firmware

Nebula Lte3301 Plus Firmware

Ee6510 10 Firmware

Emg3525 T50b Firmware

Emg5523 T50b Firmware

Vmg3625 T50b Firmware

Vmg4005 B50a Firmware

Vmg4005 B60a Firmware

Vmg8623 T50b Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte3301 Plus Firmware	Before 1.00\(abqu.9\)c0

Running on/with	Platform Versions
Zyxel Lte3301 Plus	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Fwa505 Firmware	Before 1.60\(acko.2\)v0

Running on/with	Platform Versions
Zyxel Nebula Fwa505	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Fwa510 Firmware	Before 1.60\(acgd.0\)c0

Running on/with	Platform Versions
Zyxel Nebula Fwa510	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Fwa515 Firmware	Before 1.60\(acpz.0\)v0

Running on/with	Platform Versions
Zyxel Nebula Fwa515	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Fwa710 Firmware	Before 1.60\(acgc.1\)v0

Running on/with	Platform Versions
Zyxel Nebula Fwa710	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ee5301 00 Firmware	Before 5.63\(acld.2.1\)c0

Running on/with	Platform Versions
Zyxel Ee5301 00	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ee3301 00 Firmware	Before 5.63\(acmu.2.1\)c0

Running on/with	Platform Versions
Zyxel Ee3301 00	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx5401 B1 Firmware	Before 5.17\(abyo.7.1\)c0

Running on/with	Platform Versions
Zyxel Dx5401 B1	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx4510 B1 Firmware	Before 5.17\(abyl.10.1\)c0

Running on/with	Platform Versions
Zyxel Dx4510 B1	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx4510 B0 Firmware	Before 5.17\(abyl.10.1\)c0

Running on/with	Platform Versions
Zyxel Dx4510 B0	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx3301 T0 Firmware	Before 5.50\(abvy.7.1\)c0

Running on/with	Platform Versions
Zyxel Dx3301 T0	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx3300 T1 Firmware	Before 5.50\(abvy.7.1\)c0

Running on/with	Platform Versions
Zyxel Dx3300 T1	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx3300 T0 Firmware	Before 5.50\(abvy.7.1\)c0

Running on/with	Platform Versions
Zyxel Dx3300 T0	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Lte3301 Plus Firmware	Before 1.18\(acca.6\)v0

Running on/with	Platform Versions
Zyxel Nebula Lte3301 Plus	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ee6510 10 Firmware	Before 5.19\(acjq.4.1\)c0

Running on/with	Platform Versions
Zyxel Ee6510 10	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Emg3525 T50b Firmware	Before 5.50\(abpm.9.7\)c0

Running on/with	Platform Versions
Zyxel Emg3525 T50b	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Emg5523 T50b Firmware	Before 5.50\(abpm.9.7\)c0

Running on/with	Platform Versions
Zyxel Emg5523 T50b	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex2210 T0 Firmware	Before 5.50\(acdi.2.3\)c0

Running on/with	Platform Versions
Zyxel Ex2210 T0	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3300 T0 Firmware	Before 5.50\(abvy.7.1\)c0

Running on/with	Platform Versions
Zyxel Ex3300 T0	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3300 T1 Firmware	Before 5.50\(abvy.7.1\)c0

Running on/with	Platform Versions
Zyxel Ex3300 T1	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3301 T0 Firmware	Before 5.50\(abvy.7.1\)c0

Running on/with	Platform Versions
Zyxel Ex3301 T0	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3500 T0 Firmware	Before 5.44\(achr.5.1\)c0

Running on/with	Platform Versions
Zyxel Ex3500 T0	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3501 T0 Firmware	Before 5.44\(achr.5.1\)c0

Running on/with	Platform Versions
Zyxel Ex3501 T0	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3510 B0 Firmware	Before 5.17\(abup.15.2\)c0

Running on/with	Platform Versions
Zyxel Ex3510 B0	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3510 B1 Firmware	Before 5.17\(abup.15.2\)c0

Running on/with	Platform Versions
Zyxel Ex3510 B1	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3600 T0 Firmware	Before 5.70\(acif.2.1\)c0

Running on/with	Platform Versions
Zyxel Ex3600 T0	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5401 B1 Firmware	Before 5.17\(abyo.7.1\)c0

Running on/with	Platform Versions
Zyxel Ex5401 B1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5510 B0 Firmware	Before 5.17\(abqx.11.1\)c0

Running on/with	Platform Versions
Zyxel Ex5510 B0	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5512 T0 Firmware	Before 5.70\(aceg.5.3\)c0

Running on/with	Platform Versions
Zyxel Ex5512 T0	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5601 T0 Firmware	Before 5.70\(acdz.5.1\)c0

Running on/with	Platform Versions
Zyxel Ex5601 T0	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5601 T1 Firmware	Before 5.70\(acdz.5.1\)c0

Running on/with	Platform Versions
Zyxel Ex5601 T1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex7501 B0 Firmware	Before 5.18\(achn.3.1\)c0

Running on/with	Platform Versions
Zyxel Ex7501 B0	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex7710 B0 Firmware	Before 5.18\(acak.1.6\)c0

Running on/with	Platform Versions
Zyxel Ex7710 B0	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gm4100 B0 Firmware	Before 5.18\(accl.2\)c0

Running on/with	Platform Versions
Zyxel Gm4100 B0	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm7500 00 Firmware	Before 5.61\(ackk.1.2\)c0

Running on/with	Platform Versions
Zyxel Pm7500 00	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg3625 T50b Firmware	Before 5.50\(abpm.9.7\)c0

Running on/with	Platform Versions
Zyxel Vmg3625 T50b	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg4005 B50a Firmware	Before 5.17\(abqa.3.2\)c0

Running on/with	Platform Versions
Zyxel Vmg4005 B50a	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg4005 B60a Firmware	Before 5.17\(abqa.3.2\)c0

Running on/with	Platform Versions
Zyxel Vmg4005 B60a	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ax7501 B1 Firmware	Before 5.17\(abpc.7.1\)c0

Running on/with	Platform Versions
Zyxel Ax7501 B1	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pe3301 00 Firmware	Before 5.63\(acmt.2.1\)c0

Running on/with	Platform Versions
Zyxel Pe3301 00	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pe5301 01 Firmware	Before 5.63\(acoj.2.1\)c0

Running on/with	Platform Versions
Zyxel Pe5301 01	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm3100 T0 Firmware	Before 5.42\(acbf.4.1\)c0

Running on/with	Platform Versions
Zyxel Pm3100 T0	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm5100 T0 Firmware	Before 5.42\(acbf.4.1\)c0

Running on/with	Platform Versions
Zyxel Pm5100 T0	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm5100 T1 Firmware	Before 5.42\(acbf.4.1\)c0

Running on/with	Platform Versions
Zyxel Pm5100 T1	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm7300 T0 Firmware	Before 5.42\(abyy.4.1\)c0

Running on/with	Platform Versions
Zyxel Pm7300 T0	All versions

Configuration T

1 vulnerable

Vulnerable Software	Affected Versions
Zyxel Px3321 T1 Firmware	Before 5.44\(achk.3\)c0

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Px3321 T1 Firmware	Before 5.44\(acjb.1.5\)c0

Running on/with	Platform Versions
Zyxel Px3321 T1	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Px5301 T0 Firmware	Before 5.44\(ackb.0.6\)c0

Running on/with	Platform Versions
Zyxel Px5301 T0	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Scr 50axe Firmware	Before 1.30\(acgn.0\)c0

Running on/with	Platform Versions
Zyxel Scr 50axe	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg8623 T50b Firmware	Before 5.50\(abpm.9.7\)c0

Running on/with	Platform Versions
Zyxel Vmg8623 T50b	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel We3300 00 Firmware	Before 5.70\(acka.1.1\)c0

Running on/with	Platform Versions
Zyxel We3300 00	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx3100 T0 Firmware	Before 5.50\(abvl.4.9\)c0

Running on/with	Platform Versions
Zyxel Wx3100 T0	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx3401 B1 Firmware	Before 5.17\(abve.2.10\)c0

Running on/with	Platform Versions
Zyxel Wx3401 B1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx5600 T0 Firmware	Before 5.70\(aceb.5.1\)c0

Running on/with	Platform Versions
Zyxel Wx5600 T0	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx5610 B0 Firmware	Before 5.18\(acgj.0.5\)c0

Running on/with	Platform Versions
Zyxel Wx5610 B0	All versions

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (1)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

Source: security@zyxel.com.tw

Vendor Advisory

Timeline

No history available yet.