Executive Summary

CVE-2025-11846 is a null pointer dereference vulnerability found in the account settings CGI program of certain Zyxel devices. This vulnerability allows an authenticated attacker with administrator privileges to cause a denial-of-service (DoS) condition by sending a specially crafted HTTP request to the affected device.

The attack requires administrator-level authentication and can only be exploited if the device’s WAN access is enabled and user-configured passwords have been compromised, as WAN access is disabled by default on these devices.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition on the affected Zyxel device. This means the device could become unresponsive or stop functioning properly, potentially disrupting network connectivity or services that rely on the device.

Exploitation requires that the attacker has administrator access and that WAN access is enabled with compromised passwords, which could lead to service interruptions and operational downtime.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for specially crafted HTTP requests sent to the account settings CGI program on affected Zyxel devices. Since exploitation requires administrator-level authentication and involves sending crafted HTTP requests, inspecting HTTP logs for unusual or malformed requests targeting the account settings CGI endpoint may help identify attempts.

Additionally, verifying the firmware version on your Zyxel devices can help detect if they are vulnerable. Devices running firmware versions through 5.50(ABPM.9.6)C0 for VMG3625-T50B and through 5.50(ABVL.4.8)C0 for WX3100-T0 are affected.

Suggested commands to check firmware version on Zyxel devices typically include accessing the device via SSH or web interface and running commands like:

• ssh admin@<device_ip>
• show version
• cat /etc/version

For network detection, using tools like tcpdump or Wireshark to capture HTTP traffic and filter for requests to the account settings CGI endpoint may help identify suspicious activity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the latest firmware updates released by Zyxel for all affected devices and models. Zyxel has provided patches for all vulnerable firmware versions.

Since exploitation requires administrator privileges and WAN access enabled, ensure that WAN access is disabled if not needed, and change all user-configured passwords to strong, unique passwords to prevent unauthorized access.

Contact Zyxel sales or support to obtain the appropriate firmware updates and apply them promptly to reduce the risk of exploitation.

Useful 0 Not Useful 0