Cyber Resilience

CVE-2025-11848

Memory Safety in Zyxel Px3321-T1 Firmware ≤ 5.44\(achk.3\)c0

Published
24 February 2026
Modified
25 February 2026
Patch / advisory
CVSS Score v3.1 4.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.018 77th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-11848 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Zyxel Px3321-T1 Firmware. Its CVSS base score is 4.9 (Medium).

Operationally, ranked in the top 23% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-11 (Error Handling) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition…

more

by sending a crafted HTTP request.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-11847Same product: Zyxel Ax7501-B1
CVE-2025-11846Same product: Zyxel Ax7501-B1
CVE-2025-11845Same product: Zyxel Ax7501-B1
CVE-2025-13943Same product: Zyxel Ax7501-B1
CVE-2025-8693Same product: Zyxel Ax7501-B1
CVE-2024-38268Same product: Zyxel Ax7501-B1
CVE-2024-38267Same product: Zyxel Ax7501-B1
CVE-2024-38269Same product: Zyxel Ax7501-B1
CVE-2024-38266Same product: Zyxel Ax7501-B1
CVE-2025-6599Same product: Zyxel Ax7501-B1

Affected Assets

zyxel
ee5301-00 firmware
≤ 5.63\(acld.2.1\)c0
zyxel
ee3301-00 firmware
≤ 5.63\(acmu.2.1\)c0
zyxel
dx5401-b1 firmware
≤ 5.17\(abyo.7.1\)c0
zyxel
dx4510-b1 firmware
≤ 5.17\(abyl.10.1\)c0
zyxel
dx4510-b0 firmware
≤ 5.17\(abyl.10.1\)c0
zyxel
dx3301-t0 firmware
≤ 5.50\(abvy.7.1\)c0
zyxel
dx3300-t1 firmware
≤ 5.50\(abvy.7.1\)c0
zyxel
dx3300-t0 firmware
≤ 5.50\(abvy.7.1\)c0
zyxel
ee6510-10 firmware
≤ 5.19\(acjq.4.1\)c0
zyxel
emg3525-t50b firmware
≤ 5.50\(abpm.9.7\)c0
+38 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-11 Error Handling
  • SC-24 Fail in Known State
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly blocks the crafted HTTP request from reaching the Wake-on-LAN CGI and triggering the null-pointer dereference.

prevent

Requires the CGI to handle null dereference conditions gracefully instead of crashing into a DoS state.

prevent

Ensures the device fails to a known non-DoS state when the CGI encounters the null-pointer fault.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect NULL dereference defects before release.

prevents

Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.

prevents

Application security requirements can specify input validation and pointer-safety rules.

prevents

Secure architecture principles encourage defensive design that avoids unsafe pointer use.

prevents

Secure coding standards directly require NULL-pointer checks and safe dereference patterns.

References