Zyxel DX3301-T0 CVE-2025-6599

Exploitation requires network reachability to the device's HTTP-based web management interface; no authentication, user interaction, or special configuration is needed (PR:N/UI:N) against affected firmware (DX3301-T0 5.50(ABVY.6.3)C0 and earlier, plus the broader Zyxel CPE/router line in the CPE list). The key limiting factor is exposure: impact is confined to the web management plane only - data-plane/networking services continue operating - and the disruption is temporary, lasting only while the attacker sustains the connection flood. Risk is substantially reduced where the management interface is not exposed to the WAN/Internet and is restricted to trusted management networks, which is the recommended default for CPE devices.

This is a textbook case of a high CVSS base score that overstates real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H, score 7.5) reflects remote, unauthenticated, low-complexity exploitation with high availability impact - but the impact is scoped narrowly: the description states only the web management interface is temporarily disrupted while 'other networking services remain unaffected,' which argues against a true A:H rating. Corroborating signals point to low priority: EPSS is 0.08% (24th percentile), the CVE is NOT on CISA KEV, and there is no public exploit or active-exploitation evidence. The attack is a Slowloris-style DoS (CWE-400), a well-understood, non-destructive technique that causes no data confidentiality or integrity loss (C:N/I:N) and no code execution - it merely ties up HTTP worker connections. Net assessment: real but low-severity; this is a management-plane availability nuisance, not a critical threat, and should be patched on a routine cycle rather than emergency-escalated. Note a data gap: the CVE description names only the DX3301-T0, yet the CPE list and tags enumerate dozens of additional Zyxel firmware images - verify the full affected scope against the Zyxel advisory.

A remote, unauthenticated attacker with network reachability to a device's HTTP management interface opens many partial/slow HTTP connections (Slowloris) and holds them open, exhausting the web server's connection pool. Legitimate administrators are then temporarily unable to reach the web management UI until the attack stops, though routing, LTE/5G, and other services keep functioning. No public exploit code is identified at time of analysis, but Slowloris tooling is generic and widely available.