#VU123161 NULL pointer dereference in ZyXEL Communications Corp. products - CVE-2025-11846

Vulnerability identifier: #VU123161

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2025-11846

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
LTE3301-PLUS
DX4510-B0
Nebula FWA505
Nebula FWA510
Nebula FWA515
Nebula FWA710
Nebula LTE3301-PLUS
DX3300-T0
DX3300-T1
DX3301-T0
DX4510-B1
DX5401-B1
EE3301-00
EE5301-00
EE6510-10
EX2210-T0
EX3300-T0
EX3300-T1
EX3301-T0
EX3500-T0
EX3501-T0
EX3510-B1
EX3600-T0
EX5401-B1
EX5512-T0
EX5601-T0
EX5601-T1
EX7501-B0
EX7710-B0
GM4100-B0
VMG4005-B50A
VMG4005-B60A
AX7501-B1
PE3301-00
PE5301-01
PM3100-T0
PM5100-T0
PM5100-T1
PM7500-00
PX3321-T1
PX5301-T0
SCR 50AXE
WE3300-00
WX3100-T0
WX3401-B1
WX5600-T0
WX5610-B0
EMG3525-T50B
EMG5523-T50B
EX3510-B0
EX5510-B0
VMG3625-T50B
VMG8623-T50B
PM7300-T0

Software vendor:
ZyXEL Communications Corp.

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the account settings CGI program. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026