CVE-2025-6599 Denial of service in DX3301-T0 firmware

Medium 5.3 Published 18 Nov 2025 Updated 18 Nov 2025

Attackers can cause denial of service on the web management interface via Slowloris attacks, requiring firmware upgrades.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-6599?

CVE-2025-6599 is a medium-severity denial of service vulnerability in Zyxel DX3301-T0 firmware, published on 18 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service (DoS) attacks. Such attacks may temporarily block legitimate HTTP requests and partially disrupt access to the web management interface, while other networking services remain unaffected.

Weakness: CWE-400

Which versions are affected by CVE-2025-6599?

It affects 66 products.

Products include Zyxel Ax7501-B0 Firmware, Zyxel Ax7501-B1 Firmware, Zyxel Dm4200-B0 Firmware, Zyxel Dx3300-T0 Firmware, Zyxel Dx3300-T1 Firmware, Zyxel Dx3301-T0 Firmware and 60 more.

How do I fix CVE-2025-6599?

No fix has been published for CVE-2025-6599 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-6599 being exploited?

There is no known exploitation of CVE-2025-6599 in the wild and no public exploit code.

Sources

Also known as GHSA-r99r-5wp8-8w99.