What is the CVSS score of CVE-2026-3870?

CVE-2026-3870 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Zyxel VMG4005-B50B CVE-2026-3870

EUVD-2026-33873 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-06-02 Zyxel

GHSA-r75m-m2v9-89vv

Zyxel Buffer Overflow

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 02:46 vuln.today

DescriptionCVE.org

A buffer overflow vulnerability in the UPnP AddPortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent attacker to trigger a temporary denial-of-service (DoS) condition affecting the UPnP function of the affected device.

AnalysisAI

Buffer overflow in the UPnP AddPortMapping() command handler on Zyxel VMG4005-B50B DSL/Ethernet CPE devices allows adjacent unauthenticated attackers to crash the UPnP service, causing a temporary denial-of-service condition. Affected firmware versions run through 5.13(ABRL.5.4)C0, and the vulnerability was self-disclosed by Zyxel in a June 2026 advisory covering multiple CPE product lines. No public exploit code exists and this vulnerability has not been confirmed as actively exploited (not in CISA KEV).

Technical ContextAI

CWE-120 (Classic Buffer Overflow) describes the root cause: the UPnP AddPortMapping() handler fails to properly validate the length or bounds of attacker-supplied input before writing it into a fixed-size buffer, corrupting adjacent memory and crashing the UPnP service process. UPnP uses SOAP over HTTP (typically on port 1900/UDP for discovery and a TCP port for control), allowing LAN-side clients to dynamically request port-forwarding rules from the router. The affected CPE string (cpe:2.3:a:zyxel:vmg4005-b50b_firmware) identifies the VMG4005-B50B as a DSL/Ethernet CPE device - a class of customer-premises equipment commonly deployed by ISPs. Because UPnP is frequently enabled by default on consumer and SOHO routers, the attack surface is present in typical deployments. The CVSS attack vector of Adjacent (AV:A) confines exploitation to the same broadcast domain or directly connected network segment rather than the open internet.

RemediationAI

Consult the Zyxel security advisory at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerabilities-in-the-upnp-function-of-certain-4g-lte-5g-nr-cpe-and-dsl-ethernet-cpe-06-02-2026 for patched firmware versions - a specific fix version was not included in the available input data, so 'Patch available per vendor advisory' is the confirmed status. Apply any Zyxel-released firmware update above version 5.13(ABRL.5.4)C0 once validated. As a compensating control, disable UPnP on the VMG4005-B50B via the device administration interface if UPnP is not required by connected clients; this eliminates the attack surface entirely but may break applications that rely on automatic port mapping (e.g., gaming consoles, VoIP clients, BitTorrent). Restrict LAN-side access to the UPnP control port if the device supports per-interface UPnP scoping. For ISP-managed deployments, consider pushing a configuration policy that disables UPnP fleet-wide pending firmware availability.