CVE-2025-11847 Null dereference in VMG3625-T50B firmware

Medium 4.9 Published 24 Feb 2026 Updated 24 Feb 2026

An authenticated administrator can cause a denial-of-service condition in Zyxel routers by sending a crafted HTTP request to the IP settings CGI program.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-11847?

CVE-2025-11847 is a medium-severity vulnerability in Zyxel VMG3625-T50B firmware, published on 24 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

Weakness: CWE-476

Which versions are affected by CVE-2025-11847?

It affects 54 products.

Products include Zyxel Ax7501-B1 Firmware, Zyxel Dx3300-T0 Firmware, Zyxel Dx3300-T1 Firmware, Zyxel Dx3301-T0 Firmware, Zyxel Dx4510-B0 Firmware, Zyxel Dx4510-B1 Firmware and 48 more.

How do I fix CVE-2025-11847?

No fix has been published for CVE-2025-11847 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-11847 being exploited?

There is no known exploitation of CVE-2025-11847 in the wild and no public exploit code.

Sources

Also known as GHSA-qhmq-843h-9vq8.