High severity · published Nov 18, 2025
CVE-2025-6599
An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform…
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service (DoS) attacks. Such attacks may temporarily block legitimate HTTP requests and partially disrupt access to the web management interface, while other networking services remain unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
DX3301-T0 firmware · Zyxel
<= 5.50(ABVY.6.3)C0 · source: vendor, NVD
AF
Ax7501-b0 Firmware · Zyxel
through 5.17\(abpc.6.1\)c0 · source: NVD
AF
Ax7501-b1 Firmware · Zyxel
through 5.17\(abpc.6.1\)c0 · source: NVD
DF
Dm4200-b0 Firmware · Zyxel
through 5.17\(acbs.1.3\)c0 · source: NVD
DF
Dx3300-t0 Firmware · Zyxel
through 5.50\(abvy.6.3\)c0 · source: NVD
DF
Dx3300-t1 Firmware · Zyxel
through 5.50\(abvy.6.3\)c0 · source: NVD
DF
Dx4510-b1 Firmware · Zyxel
through 5.17\(abyl.9\)c0 · source: NVD
DF
Dx5401-b0 Firmware · Zyxel
through 5.17\(abyo.7\)b2 · source: NVD
DF
Dx5401-b1 Firmware · Zyxel
through 5.17\(abyo.7\)b2 · source: NVD
EF
Ee3301-00 Firmware · Zyxel
through 5.63\(acmu.1.1\)c0 · source: NVD
EF
Ee5301-00 Firmware · Zyxel
through 5.63\(acld.1.1\)c0 · source: NVD
EF
Ee6510-10 Firmware · Zyxel
through 5.19\(acjq.3\)c0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6599
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6599
Vendor Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-uncontrolled-resource-consumption-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-11-18-2025
More from DX3301-T0 firmware
8.8
CVE-2025-13943
A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an…
8.8
CVE-2025-8693
A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated…
8.8
CVE-2022-43390
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on…
7.5
CVE-2024-8748
A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0 could allow an…
7.5
CVE-2024-5412
A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 could allow an unauthenticated attacker to cause denial of…