CVE-2025-7673

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-16 · updated 2026-06-17
Weakness: CWE-120

Description

A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request.

Affected products

Zyxel Emg3525-T50B Firmware: before 5.50\(abpm.4\)c0; before 5.50\(absl.0\)b8 — fixed in 5.50\(abpm.4\)c0, 5.50\(absl.0\)b8
Zyxel Emg5523-T50B Firmware: before 5.50\(abpm.4\)c0; before 5.50\(absl.0\)b8 — fixed in 5.50\(abpm.4\)c0, 5.50\(absl.0\)b8
Zyxel Emg5723-T50K Firmware: before 5.50\(abom.5\)c0 — fixed in 5.50\(abom.5\)c0
Zyxel Emg6726-B10A Firmware: before 5.13\(abnp.6\).c — fixed in 5.13\(abnp.6\).c
Zyxel EX3510-B0 firmware: before 5.17\(abup.3\)c0 — fixed in 5.17\(abup.3\)c0
Zyxel Ex5510-B0 Firmware: before 5.15\(abqx.3\)c0 — fixed in 5.15\(abqx.3\)c0
Zyxel Vmg1312-T20B Firmware: before 5.50\(absb.3\)c0 — fixed in 5.50\(absb.3\)c0
Zyxel VMG3625-T50B firmware: before 5.50\(abpm.4\)c0 — fixed in 5.50\(abpm.4\)c0
Zyxel Vmg3925-B10B Firmware: before 5.13\(aavf.16\)c — fixed in 5.13\(aavf.16\)c
Zyxel Vmg3925-B10C Firmware: before 5.13\(aavf.16\)c — fixed in 5.13\(aavf.16\)c
Zyxel Vmg3927-B50A Firmware: before 5.15\(abmt.5\)c0 — fixed in 5.15\(abmt.5\)c0
Zyxel Vmg3927-B50B Firmware: before 5.13\(ably.6\)c0 — fixed in 5.13\(ably.6\)c0
Zyxel Vmg3927-B60A Firmware: before 5.15\(abmt.5\)c0 — fixed in 5.15\(abmt.5\)c0
Zyxel Vmg3927-T50K Firmware: before 5.50\(abom.5\)c0 — fixed in 5.50\(abom.5\)c0
Zyxel VMG4005-B50B firmware: before 5.13\(abrl.5\)c0 — fixed in 5.13\(abrl.5\)c0
Zyxel Vmg4927-B50A Firmware: before 5.13\(ably.6\)c0 — fixed in 5.13\(ably.6\)c0
Zyxel Vmg8623-T50B Firmware: before 5.50\(abpm.4\)c0 — fixed in 5.50\(abpm.4\)c0
Zyxel Vmg8825-B50A Firmware: before 5.15\(abmt.5\)c0 — fixed in 5.15\(abmt.5\)c0
Zyxel Vmg8825-B60A Firmware: before 5.15\(abmt.5\)c0 — fixed in 5.15\(abmt.5\)c0
Zyxel Vmg8825-Bx0B Firmware: before 5.17\(abny.5\)c0 — fixed in 5.17\(abny.5\)c0
Zyxel VMG8825-T50K firmware: before 5.50\(abom.5\)c0 — fixed in 5.50\(abom.5\)c0
Zyxel Vmg8924-B10D Firmware: before 5.13\(abgq.6\)c0 — fixed in 5.13\(abgq.6\)c0
Zyxel Xmg3927-B50A Firmware: before 5.15\(abmt.5\)c0 — fixed in 5.15\(abmt.5\)c0
Zyxel Xmg8825-B50A Firmware: before 5.17\(abmt.5\)c0 — fixed in 5.17\(abmt.5\)c0

How to fix

Upgrade to a fixed version: Zyxel Emg3525-T50B Firmware 5.50\(abpm.4\)c0, 5.50\(absl.0\)b8; Zyxel Emg5523-T50B Firmware 5.50\(abpm.4\)c0, 5.50\(absl.0\)b8; Zyxel Emg5723-T50K Firmware 5.50\(abom.5\)c0; Zyxel Emg6726-B10A Firmware 5.13\(abnp.6\).c; Zyxel EX3510-B0 firmware 5.17\(abup.3\)c0; Zyxel Ex5510-B0 Firmware 5.15\(abqx.3\)c0; Zyxel Vmg1312-T20B Firmware 5.50\(absb.3\)c0; Zyxel VMG3625-T50B firmware 5.50\(abpm.4\)c0; Zyxel Vmg3925-B10B Firmware 5.13\(aavf.16\)c; Zyxel Vmg3925-B10C Firmware 5.13\(aavf.16\)c; Zyxel Vmg3927-B50A Firmware 5.15\(abmt.5\)c0; Zyxel Vmg3927-B50B Firmware 5.13\(ably.6\)c0. Check the vendor advisory for mitigations.

References

https://www.zyxel.com/service-provider/global/en/zyxel-security-advisory-remote-code-execution-and-denial-service-vulnerabilities-cpe

Get alerted when CVE-2025-7673 or the next vulnerability affects your stack