NULL pointer dereference in ZyXEL Communications Corp. products - CVE-2025-11847

Vulnerability identifier: #VU123162

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-11847

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the IP settings CGI program. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.

VMG3625-T50B
EMG3525-T50B
EMG5523-T50B
VMG8623-T50B
EX3510-B0
EX5510-B0
PM7300-T0
EE6510-10
PE5301-01
PE3301-00
AX7501-B1
EX2210-T0
EX3300-T0
VMG4005-B60A
EX3300-T1
VMG4005-B50A
EX3301-T0
PM3100-T0
EX3500-T0
GM4100-B0
EX3501-T0
EX7710-B0
EX7501-B0
EX3510-B1
EX5601-T1
EX3600-T0
EX5601-T0
EX5401-B1
EX5512-T0
DX3300-T1
Nebula FWA505
WX5610-B0
Nebula FWA510
WX5600-T0
Nebula FWA515
WX3401-B1
Nebula FWA710
WX3100-T0
Nebula LTE3301-PLUS
WE3300-00
DX3300-T0
SCR 50AXE
PX5301-T0
DX3301-T0
PX3321-T1
PM7500-00
DX4510-B1
DX5401-B1
PM5100-T1
EE3301-00
PM5100-T0
EE5301-00
LTE3301-PLUS
DX4510-B0

Install updates from vendor's website.

VMG3625-T50B - update to 5.50(ABPM.9.7)C0
EE6510-10 - update to 5.19(ACJQ.4.1)C0
PE5301-01 - update to 5.63(ACOJ.2.1)C0
EMG3525-T50B - update to 5.50(ABPM.9.7)C0
PE3301-00 - update to 5.63(ACMT.2.1)C0
EMG5523-T50B - update to 5.50(ABPM.9.7)C0
AX7501-B1 - update to 5.17(ABPC.7.1)C0
EX2210-T0 - update to 5.50(ACDI.2.3)C0
VMG8623-T50B - update to 5.50(ABPM.9.7)C0
EX3300-T0 - update to 5.50(ABVY.7.1)C0
VMG4005-B60A - update to 5.17(ABQA.3.2)C0
EX3300-T1 - update to 5.50(ABVY.7.1)C0
VMG4005-B50A - update to 5.17(ABQA.3.2)C0
EX3301-T0 - update to 5.50(ABVY.7.1)C0
PM3100-T0 - update to 5.42(ACBF.4.1)C0
EX3500-T0 - update to 5.44(ACHR.5.1)C0
GM4100-B0 - update to 5.18(ACCL.2)C0
EX3501-T0 - update to 5.44(ACHR.5.1)C0
EX7710-B0 - update to 5.18(ACAK.1.6)C0
EX3510-B0 - update to 5.17(ABUP.15.2)C0
EX7501-B0 - update to 5.18(ACHN.3.1)C0
EX3510-B1 - update to 5.17(ABUP.15.2)C0
EX5601-T1 - update to 5.70(ACDZ.5.1)C0
EX3600-T0 - update to 5.70(ACIF.2.1)C0
EX5601-T0 - update to 5.70(ACDZ.5.1)C0
EX5401-B1 - update to 5.17(ABYO.7.1)C0
EX5512-T0 - update to 5.70(ACEG.5.3)C0
EX5510-B0 - update to 5.17(ABQX.11.1)C0
DX3300-T1 - update to 5.50(ABVY.7.1)C0
LTE3301-PLUS - update to 1.00(ABQU.9)C0
Nebula FWA505 - update to 1.60(ACKO.2)V0
WX5610-B0 - update to 5.18(ACGJ.0.5)C0
Nebula FWA510 - update to 1.60(ACGD.0)C0
WX5600-T0 - update to 5.70(ACEB.5.1)C0
Nebula FWA515 - update to 1.60(ACPZ.0)V0
WX3401-B1 - update to 5.17(ABVE.2.10)C0
Nebula FWA710 - update to 1.60(ACGC.1)V0
WX3100-T0 - update to 5.50(ABVL.4.9)C0
Nebula LTE3301-PLUS - update to 1.18(ACCA.6)V0
WE3300-00 - update to 5.70(ACKA.1.1)C0
DX3300-T0 - update to 5.50(ABVY.7.1)C0
SCR 50AXE - update to 1.30(ACGN.0)C0
PX5301-T0 - update to 5.44(ACKB.0.6)C0
DX3301-T0 - update to 5.50(ABVY.7.1)C0
PX3321-T1 - addressed in versions 5.44(ACJB.1.5)C0, 5.44(ACHK.3)C0
DX4510-B0 - update to 5.17(ABYL.10.1)C0
PM7500-00 - update to 5.61(ACKK.1.2)C0
DX4510-B1 - update to 5.17(ABYL.10.1)C0
PM7300-T0 - update to 5.42(ABYY.4.1)C0
DX5401-B1 - update to 5.17(ABYO.7.1)C0
PM5100-T1 - update to 5.42(ACBF.4.1)C0
EE3301-00 - update to 5.63(ACMU.2.1)C0
PM5100-T0 - update to 5.42(ACBF.4.1)C0
EE5301-00 - update to 5.63(ACLD.2.1)C0

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

• Multiple vulnerabilities in Zyxel products