CVE-2025-7673
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K...
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request.
- Record
CVE-2025-7673- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2025-21579
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request.
- Record
EUVD-2025-21579- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r3pp-h225-m34v
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K...
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request.
- Record
GHSA-r3pp-h225-m34v- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a specially crafted HTTP request.
- Record
CVE-2025-7673- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
Affected products
- zyxel vmg8825-t50k firmware
- zyxel emg3525-t50b firmware
- zyxel emg5523-t50b firmware
- zyxel emg5723-t50k firmware
- zyxel emg6726-b10a firmware
- zyxel ex3510-b0 firmware
- zyxel ex5510-b0 firmware
- zyxel vmg1312-t20b firmware
- zyxel vmg3625-t50b firmware
- zyxel vmg3925-b10b firmware
- zyxel vmg3925-b10c firmware
- zyxel vmg3927-b50a firmware
Show 12 moreShow less
- zyxel vmg3927-b50b firmware
- zyxel vmg3927-b60a firmware
- zyxel vmg3927-t50k firmware
- zyxel vmg4005-b50b firmware
- zyxel vmg4927-b50a firmware
- zyxel vmg8623-t50b firmware
- zyxel vmg8825-b50a firmware
- zyxel vmg8825-b60a firmware
- zyxel vmg8825-bx0b firmware
- zyxel vmg8924-b10d firmware
- zyxel xmg3927-b50a firmware
- zyxel xmg8825-b50a firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-7673 is a critical vulnerability (CVSS 9.8) in Zyxel Vmg8825-t50k Firmware, published July 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. No source names a fixed version.