Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Zyxel VMG8825-T50K web server crashes or runs malicious code from faulty HTTP requests

CVE-2025-7673 · published 1 year ago
Summary

The Zyxel VMG8825-T50K web server in older firmware versions can crash or be exploited by a malicious HTTP request, potentially allowing an attacker to disrupt service or take control of the device. You should update the firmware to the latest version to prevent this.

What to do
  • Update zyxel emg5723-t50k_firmware to version 5.50\(abom.5\)c0 or later.
  • Update zyxel emg6726-b10a_firmware to version 5.13\(abnp.6\).c or later.
  • Update zyxel ex3510-b0_firmware to version 5.17\(abup.3\)c0 or later.
  • Update zyxel ex5510-b0_firmware to version 5.15\(abqx.3\)c0 or later.
  • Update zyxel vmg1312-t20b_firmware to version 5.50\(absb.3\)c0 or later.
  • Update zyxel vmg3625-t50b_firmware to version 5.50\(abpm.4\)c0 or later.
  • Update zyxel vmg3925-b10b_firmware to version 5.13\(aavf.16\)c or later.
  • Update zyxel vmg3925-b10c_firmware to version 5.13\(aavf.16\)c or later.
  • Update zyxel vmg3927-b50a_firmware to version 5.15\(abmt.5\)c0 or later.
  • Update zyxel vmg3927-b60a_firmware to version 5.15\(abmt.5\)c0 or later.
  • Update zyxel vmg3927-b50b_firmware to version 5.13\(ably.6\)c0 or later.
  • Update zyxel vmg3927-t50k_firmware to version 5.50\(abom.5\)c0 or later.
  • Update zyxel vmg4005-b50b_firmware to version 5.13\(abrl.5\)c0 or later.
  • Update zyxel vmg4927-b50a_firmware to version 5.13\(ably.6\)c0 or later.
  • Update zyxel vmg8623-t50b_firmware to version 5.50\(abpm.4\)c0 or later.
  • Update zyxel vmg8825-b50a_firmware to version 5.15\(abmt.5\)c0 or later.
  • Update zyxel vmg8825-b60a_firmware to version 5.15\(abmt.5\)c0 or later.
  • Update zyxel vmg8825-bx0b_firmware to version 5.17\(abny.5\)c0 or later.
  • Update zyxel vmg8825-t50k_firmware to version 5.50\(abom.5\)c0 or later.
  • Update zyxel vmg8924-b10d_firmware to version 5.13\(abgq.6\)c0 or later.
  • Update zyxel xmg3927-b50a_firmware to version 5.15\(abmt.5\)c0 or later.
  • Update zyxel xmg8825-b50a_firmware to version 5.17\(abmt.5\)c0 or later.
Affected software
VendorProductAffected versions
zyxel emg3525-t50b_firmware < 5.50\(abpm.4\)c0
< 5.50\(absl.0\)b8
cpe:2.3:o:zyxel:emg3525-t50b_firmware:*:*:*:*:emea:*:*:*
zyxel emg5523-t50b_firmware < 5.50\(abpm.4\)c0
< 5.50\(absl.0\)b8
cpe:2.3:o:zyxel:emg5523-t50b_firmware:*:*:*:*:emea:*:*:*
zyxel emg5723-t50k_firmware < 5.50\(abom.5\)c0
cpe:2.3:o:zyxel:emg5723-t50k_firmware:*:*:*:*:*:*:*:*
zyxel emg6726-b10a_firmware < 5.13\(abnp.6\).c
cpe:2.3:o:zyxel:emg6726-b10a_firmware:*:*:*:*:*:*:*:*
zyxel ex3510-b0_firmware < 5.17\(abup.3\)c0
cpe:2.3:o:zyxel:ex3510-b0_firmware:*:*:*:*:*:*:*:*
zyxel ex5510-b0_firmware < 5.15\(abqx.3\)c0
cpe:2.3:o:zyxel:ex5510-b0_firmware:*:*:*:*:*:*:*:*
zyxel vmg1312-t20b_firmware < 5.50\(absb.3\)c0
cpe:2.3:o:zyxel:vmg1312-t20b_firmware:*:*:*:*:*:*:*:*
zyxel vmg3625-t50b_firmware < 5.50\(abpm.4\)c0
cpe:2.3:o:zyxel:vmg3625-t50b_firmware:*:*:*:*:*:*:*:*
zyxel vmg3925-b10b_firmware < 5.13\(aavf.16\)c
cpe:2.3:o:zyxel:vmg3925-b10b_firmware:*:*:*:*:*:*:*:*
zyxel vmg3925-b10c_firmware < 5.13\(aavf.16\)c
cpe:2.3:o:zyxel:vmg3925-b10c_firmware:*:*:*:*:*:*:*:*
zyxel vmg3927-b50a_firmware < 5.15\(abmt.5\)c0
cpe:2.3:o:zyxel:vmg3927-b50a_firmware:*:*:*:*:*:*:*:*
zyxel vmg3927-b60a_firmware < 5.15\(abmt.5\)c0
cpe:2.3:o:zyxel:vmg3927-b60a_firmware:*:*:*:*:*:*:*:*
zyxel vmg3927-b50b_firmware < 5.13\(ably.6\)c0
cpe:2.3:o:zyxel:vmg3927-b50b_firmware:*:*:*:*:*:*:*:*
zyxel vmg3927-t50k_firmware < 5.50\(abom.5\)c0
cpe:2.3:o:zyxel:vmg3927-t50k_firmware:*:*:*:*:*:*:*:*
zyxel vmg4005-b50b_firmware < 5.13\(abrl.5\)c0
cpe:2.3:o:zyxel:vmg4005-b50b_firmware:*:*:*:*:*:*:*:*
zyxel vmg4927-b50a_firmware < 5.13\(ably.6\)c0
cpe:2.3:o:zyxel:vmg4927-b50a_firmware:*:*:*:*:*:*:*:*
zyxel vmg8623-t50b_firmware < 5.50\(abpm.4\)c0
cpe:2.3:o:zyxel:vmg8623-t50b_firmware:*:*:*:*:*:*:*:*
zyxel vmg8825-b50a_firmware < 5.15\(abmt.5\)c0
cpe:2.3:o:zyxel:vmg8825-b50a_firmware:*:*:*:*:*:*:*:*
zyxel vmg8825-b60a_firmware < 5.15\(abmt.5\)c0
cpe:2.3:o:zyxel:vmg8825-b60a_firmware:*:*:*:*:*:*:*:*
zyxel vmg8825-bx0b_firmware < 5.17\(abny.5\)c0
cpe:2.3:o:zyxel:vmg8825-bx0b_firmware:*:*:*:*:*:*:*:*
zyxel vmg8825-t50k_firmware < 5.50\(abom.5\)c0
cpe:2.3:o:zyxel:vmg8825-t50k_firmware:*:*:*:*:*:*:*:*
zyxel vmg8924-b10d_firmware < 5.13\(abgq.6\)c0
cpe:2.3:o:zyxel:vmg8924-b10d_firmware:*:*:*:*:*:*:*:*
zyxel xmg3927-b50a_firmware < 5.15\(abmt.5\)c0
cpe:2.3:o:zyxel:xmg3927-b50a_firmware:*:*:*:*:*:*:*:*
zyxel xmg8825-b50a_firmware < 5.17\(abmt.5\)c0
cpe:2.3:o:zyxel:xmg8825-b50a_firmware:*:*:*:*:*:*:*:*
Original advisory text
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-o...
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-120Classic Buffer Overflow
Timeline
Published16 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-7673 · NVD
Track software like this
Free during beta