CVE-2025-11845
Medium
Description
A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
SeverityMedium
CVSS4.9
Exploit probability—
Product
Zyxel Vmg3625-t50b Firmware
PublishedFeb 24, 2026
First seenFeb 24, 2026
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- zyxel vmg3625-t50b_firmware5.50\(abpm.9.7\)c0 or later
- zyxel lte3301-plus_firmware1.00\(abqu.9\)c0 or later
- zyxel nebula_fwa505_firmware1.60\(acko.2\)v0 or later
- zyxel nebula_fwa510_firmware1.60\(acgd.0\)c0 or later
- zyxel nebula_fwa515_firmware1.60\(acpz.0\)v0 or later
- zyxel nebula_fwa710_firmware1.60\(acgc.1\)v0 or later
- zyxel ee5301-00_firmware5.63\(acld.2.1\)c0 or later
- zyxel ee3301-00_firmware5.63\(acmu.2.1\)c0 or later
- zyxel dx5401-b1_firmware5.17\(abyo.7.1\)c0 or later
- zyxel dx4510-b1_firmware5.17\(abyl.10.1\)c0 or later
- zyxel dx4510-b0_firmware5.17\(abyl.10.1\)c0 or later
- zyxel dx3301-t0_firmware5.50\(abvy.7.1\)c0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zyxel vmg3625-t50b_firmware | v < 5.50\(abpm.9.7\)c0 | 5.50\(abpm.9.7\)c0 |
| zyxel lte3301-plus_firmware | v < 1.00\(abqu.9\)c0 | 1.00\(abqu.9\)c0 |
| zyxel nebula_fwa505_firmware | v < 1.60\(acko.2\)v0 | 1.60\(acko.2\)v0 |
| zyxel nebula_fwa510_firmware | v < 1.60\(acgd.0\)c0 | 1.60\(acgd.0\)c0 |
| zyxel nebula_fwa515_firmware | v < 1.60\(acpz.0\)v0 | 1.60\(acpz.0\)v0 |
| zyxel nebula_fwa710_firmware | v < 1.60\(acgc.1\)v0 | 1.60\(acgc.1\)v0 |
| zyxel ee5301-00_firmware | v < 5.63\(acld.2.1\)c0 | 5.63\(acld.2.1\)c0 |
| zyxel ee3301-00_firmware | v < 5.63\(acmu.2.1\)c0 | 5.63\(acmu.2.1\)c0 |
| zyxel dx5401-b1_firmware | v < 5.17\(abyo.7.1\)c0 | 5.17\(abyo.7.1\)c0 |
| zyxel dx4510-b1_firmware | v < 5.17\(abyl.10.1\)c0 | 5.17\(abyl.10.1\)c0 |
| zyxel dx4510-b0_firmware | v < 5.17\(abyl.10.1\)c0 | 5.17\(abyl.10.1\)c0 |
| zyxel dx3301-t0_firmware | v < 5.50\(abvy.7.1\)c0 | 5.50\(abvy.7.1\)c0 |
| zyxel dx3300-t1_firmware | v < 5.50\(abvy.7.1\)c0 | 5.50\(abvy.7.1\)c0 |
| zyxel dx3300-t0_firmware | v < 5.50\(abvy.7.1\)c0 | 5.50\(abvy.7.1\)c0 |
| zyxel nebula_lte3301-plus_firmware | v < 1.18\(acca.6\)v0 | 1.18\(acca.6\)v0 |
| zyxel ee6510-10_firmware | v < 5.19\(acjq.4.1\)c0 | 5.19\(acjq.4.1\)c0 |
| zyxel emg3525-t50b_firmware | v < 5.50\(abpm.9.7\)c0 | 5.50\(abpm.9.7\)c0 |
| zyxel emg5523-t50b_firmware | v < 5.50\(abpm.9.7\)c0 | 5.50\(abpm.9.7\)c0 |
| zyxel ex2210-t0_firmware | v < 5.50\(acdi.2.3\)c0 | 5.50\(acdi.2.3\)c0 |
| zyxel ex3300-t0_firmware | v < 5.50\(abvy.7.1\)c0 | 5.50\(abvy.7.1\)c0 |
| zyxel ex3300-t1_firmware | v < 5.50\(abvy.7.1\)c0 | 5.50\(abvy.7.1\)c0 |
| zyxel ex3301-t0_firmware | v < 5.50\(abvy.7.1\)c0 | 5.50\(abvy.7.1\)c0 |
| zyxel ex3500-t0_firmware | v < 5.44\(achr.5.1\)c0 | 5.44\(achr.5.1\)c0 |
| zyxel ex3501-t0_firmware | v < 5.44\(achr.5.1\)c0 | 5.44\(achr.5.1\)c0 |
| zyxel ex3510-b0_firmware | v < 5.17\(abup.15.2\)c0 | 5.17\(abup.15.2\)c0 |
| zyxel ex3510-b1_firmware | v < 5.17\(abup.15.2\)c0 | 5.17\(abup.15.2\)c0 |
| zyxel ex3600-t0_firmware | v < 5.70\(acif.2.1\)c0 | 5.70\(acif.2.1\)c0 |
| zyxel ex5401-b1_firmware | v < 5.17\(abyo.7.1\)c0 | 5.17\(abyo.7.1\)c0 |
| zyxel ex5510-b0_firmware | v < 5.17\(abqx.11.1\)c0 | 5.17\(abqx.11.1\)c0 |
| zyxel ex5512-t0_firmware | v < 5.70\(aceg.5.3\)c0 | 5.70\(aceg.5.3\)c0 |
| zyxel ex5601-t0_firmware | v < 5.70\(acdz.5.1\)c0 | 5.70\(acdz.5.1\)c0 |
| zyxel ex5601-t1_firmware | v < 5.70\(acdz.5.1\)c0 | 5.70\(acdz.5.1\)c0 |
| zyxel ex7501-b0_firmware | v < 5.18\(achn.3.1\)c0 | 5.18\(achn.3.1\)c0 |
| zyxel ex7710-b0_firmware | v < 5.18\(acak.1.6\)c0 | 5.18\(acak.1.6\)c0 |
| zyxel gm4100-b0_firmware | v < 5.18\(accl.2\)c0 | 5.18\(accl.2\)c0 |
| zyxel pm7500-00_firmware | v < 5.61\(ackk.1.2\)c0 | 5.61\(ackk.1.2\)c0 |
| zyxel vmg4005-b50a_firmware | v < 5.17\(abqa.3.2\)c0 | 5.17\(abqa.3.2\)c0 |
| zyxel vmg4005-b60a_firmware | v < 5.17\(abqa.3.2\)c0 | 5.17\(abqa.3.2\)c0 |
| zyxel ax7501-b1_firmware | v < 5.17\(abpc.7.1\)c0 | 5.17\(abpc.7.1\)c0 |
| zyxel pe3301-00_firmware | v < 5.63\(acmt.2.1\)c0 | 5.63\(acmt.2.1\)c0 |
| zyxel pe5301-01_firmware | v < 5.63\(acoj.2.1\)c0 | 5.63\(acoj.2.1\)c0 |
| zyxel pm3100-t0_firmware | v < 5.42\(acbf.4.1\)c0 | 5.42\(acbf.4.1\)c0 |
| zyxel pm5100-t0_firmware | v < 5.42\(acbf.4.1\)c0 | 5.42\(acbf.4.1\)c0 |
| zyxel pm5100-t1_firmware | v < 5.42\(acbf.4.1\)c0 | 5.42\(acbf.4.1\)c0 |
| zyxel pm7300-t0_firmware | v < 5.42\(abyy.4.1\)c0 | 5.42\(abyy.4.1\)c0 |
| zyxel px3321-t1_firmware | v < 5.44\(achk.3\)c0, v < 5.44\(acjb.1.5\)c0 | 5.44\(achk.3\)c0, 5.44\(acjb.1.5\)c0 |
| zyxel px5301-t0_firmware | v < 5.44\(ackb.0.6\)c0 | 5.44\(ackb.0.6\)c0 |
| zyxel scr_50axe_firmware | v < 1.30\(acgn.0\)c0 | 1.30\(acgn.0\)c0 |
| zyxel vmg8623-t50b_firmware | v < 5.50\(abpm.9.7\)c0 | 5.50\(abpm.9.7\)c0 |
| zyxel we3300-00_firmware | v < 5.70\(acka.1.1\)c0 | 5.70\(acka.1.1\)c0 |
| zyxel wx3100-t0_firmware | v < 5.50\(abvl.4.9\)c0 | 5.50\(abvl.4.9\)c0 |
| zyxel wx3401-b1_firmware | v < 5.17\(abve.2.10\)c0 | 5.17\(abve.2.10\)c0 |
| zyxel wx5600-t0_firmware | v < 5.70\(aceb.5.1\)c0 | 5.70\(aceb.5.1\)c0 |
| zyxel wx5610-b0_firmware | v < 5.18\(acgj.0.5\)c0 | 5.18\(acgj.0.5\)c0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.