CVE-2025-6599CWE-400denial-of-service

CVE-2025-6599

Medium · published November 18, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service (DoS) attacks. Such attacks may temporarily block legitimate HTTP requests and partially disrupt access to the web management interface, while other networking services remain unaffected.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00335 · 25.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-11-18T07:15Z
Affected products (68)
ProductVersionsFixed in
zyxel/lte3301-plus_firmware≤ 1.00\(abqu.7\)c0—
zyxel/nr5103_firmware≤ 4.19\(abyc.8\)c0—
zyxel/nr5103e_firmware≤ 1.00\(acdj.1\)c0—
zyxel/nr5309_firmware≤ 1.00\(ackp.1\)b3—
zyxel/nr7302_firmware≤ 5.00\(acha.5\)c0—
zyxel/nr7303_firmware≤ 1.00\(acei.1\)c0—
zyxel/nebula_fwa505_firmware≤ 1.19\(acko.0\)c0—
zyxel/nebula_fwa510_firmware≤ 1.20\(acgd.1\)c0—
zyxel/nebula_fwa515_firmware≤ 1.50\(acpz.0\)c0—
zyxel/nebula_fwa710_firmware≤ 1.20\(acgc.0\)c0—
zyxel/dm4200-b0_firmware≤ 5.17\(acbs.1.3\)c0—
zyxel/dx3300-t0_firmware≤ 5.50\(abvy.6.3\)c0—
zyxel/dx3300-t1_firmware≤ 5.50\(abvy.6.3\)c0—
zyxel/dx3301-t0_firmware≤ 5.50\(abvy.6.3\)c0—
zyxel/dx4510-b1_firmware≤ 5.17\(abyl.9\)c0—
zyxel/dx5401-b0_firmware≤ 5.17\(abyo.7\)b2—
zyxel/dx5401-b1_firmware≤ 5.17\(abyo.7\)b2—
zyxel/ee3301-00_firmware≤ 5.63\(acmu.1.1\)c0—
zyxel/ee5301-00_firmware≤ 5.63\(acld.1.1\)c0—
zyxel/ee6510-10_firmware≤ 5.19\(acjq.3\)c0—
zyxel/ex3300-t0_firmware≤ 5.50\(abvy.6.3\)c0—
zyxel/ex3300-t0_firmware≤ 5.50\(acdi.2.1\)c0—
zyxel/ex3300-t1_firmware≤ 5.50\(abvy.6.3\)c0—
zyxel/ex3301-t0_firmware≤ 5.50\(abvy.6.3\)c0—
zyxel/ex3500-t0_firmware≤ 5.44\(achr.4\)c0—
zyxel/ex3501-t0_firmware≤ 5.44\(achr.4\)c0—
zyxel/ex3600-t0_firmware≤ 5.70\(acif.1.2\)c0—
zyxel/ex5401-b0_firmware≤ 5.17\(abyo.7\)b2—
zyxel/ex5401-b1_firmware≤ 5.17\(abyo.7\)b2—
zyxel/ex5501-b0_firmware≤ 5.17\(abry.5.5\)c0—
zyxel/ex5510-b0_firmware≤ 5.17\(abqx.10\)c0—
zyxel/ex5512-t0_firmware≤ 5.70\(aceg.5\)c0—
zyxel/ex5601-t0_firmware≤ 5.70\(acdz.4.1\)c0—
zyxel/ex5601-t1_firmware≤ 5.70\(acdz.4.1\)c0—
zyxel/ex7501-b0_firmware≤ 5.18\(achn.2.1\)c0—
zyxel/ex7710-b0_firmware≤ 5.18\(acak.1.4\)c0—
zyxel/emg3525-t50b_firmware≤ 5.50\(abpm.9.5\)c0—
zyxel/emg5523-t50b_firmware≤ 5.50\(abpm.9.5\)c0—
zyxel/emg5723-t50k_firmware≤ 5.50\(abom.8.6\)c0—
zyxel/emg6726-b10a_firmware≤ 5.13\(abnp.8\)c0—
zyxel/gm4100-b0_firmware≤ 5.18\(accl.1\)c0—
zyxel/vmg3625-t50b_firmware≤ 5.50\(abpm.9.5\)c0—
zyxel/vmg3927-b50b_firmware≤ 5.13\(ably.10\)c0—
zyxel/vmg3927-t50k_firmware≤ 5.50\(abom.8.6\)c0—
zyxel/vmg4005-b50a_firmware≤ 5.17\(abqa.3\)c0—
zyxel/vmg4005-b60a_firmware≤ 5.17\(abqa.3\)c0—
zyxel/vmg4005-b50b_firmware≤ 5.13\(abrl.5.3\)c0—
zyxel/vmg4927-b50a_firmware≤ 5.13\(ably.10\)c0—
zyxel/vmg8623-t50b_firmware≤ 5.50\(abpm.9.5\)c0—
zyxel/vmg8825-t50k_firmware≤ 5.50\(abom.8.6\)c0—
zyxel/ax7501-b0_firmware≤ 5.17\(abpc.6.1\)c0—
zyxel/ax7501-b1_firmware≤ 5.17\(abpc.6.1\)c0—
zyxel/pe3301-00_firmware≤ 5.63\(acmt.1.1\)c0—
zyxel/pe5301-01_firmware≤ 5.63\(acoj.1.1\)c0—
zyxel/pm3100-t0_firmware≤ 5.42\(acbf.3\)c0—
zyxel/pm5100-t0_firmware≤ 5.42\(acbf.3\)c0—
zyxel/pm7500-00_firmware≤ 5.61\(ackk.1\)c0—
zyxel/pm7300-t0_firmware≤ 5.42\(abyy.3\)c0—
zyxel/px3321-t1_firmware≤ 5.44\(acjb.1.3\)c0—
zyxel/px3321-t1_firmware≤ 5.44\(achk.1\)c0—
zyxel/px5301-t0_firmware≤ 5.44\(ackb.0.4\)c0—
zyxel/scr_50axe_firmware≤ 1.10\(acgn.3\)c0—
zyxel/we3300-00_firmware≤ 5.70\(acka.0\)c0—
zyxel/wx3100-t0_firmware≤ 5.50\(abvl.4.7\)c0—
zyxel/wx3401-b0_firmware≤ 5.17\(abve.2.8\)c0—
zyxel/wx3401-b1_firmware≤ 5.17\(abve.2.8\)c0—
zyxel/wx5600-t0_firmware≤ 5.70\(aceb.4.1\)c0—
zyxel/wx5610-b0_firmware≤ 5.18\(acgj.0.3\)c0—
References (1)
EPSS history
Timeline
  • 18 NOV 01:19Z
    An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker…
    cvelistv5