What is the CVSS score of CVE-2026-3871?

CVE-2026-3871 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Zyxel VMG4005-B50B CVE-2026-3871

EUVD-2026-33876 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-06-02 Zyxel

GHSA-c8pm-7pr3-cmh3

Buffer Overflow Zyxel Vmg4005 B50B Firmware

6.5

CVSS 3.1 · Vendor: Zyxel

Severity by source

Vendor (Zyxel) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Zyxel) · only source for this CVE.

CVSS VectorVendor: Zyxel

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 02:47 vuln.today

DescriptionCVE.org

A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could allow an adjacent attacker to trigger a temporary denial-of-service (DoS) condition affecting the UPnP function of the affected device.

AnalysisAI

Buffer overflow in the UPnP DeletePortMapping() command of Zyxel VMG4005-B50B DSL/Ethernet CPE firmware (through 5.13(ABRL.5.4)C0) enables an unauthenticated adjacent-network attacker to crash the device's UPnP service. The impact is a temporary, recoverable denial-of-service confined to the UPnP function - availability is fully affected (A:H) while confidentiality and integrity remain unimpacted (C:N/I:N). No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed by Zyxel itself on 2026-06-02.

Technical ContextAI

CWE-120 (Buffer Copy without Checking Size of Input) describes the root cause: the UPnP service's handler for the DeletePortMapping() action fails to validate the length of attacker-controlled input before copying it into a fixed-size stack or heap buffer, resulting in a classic stack/heap overflow that corrupts process state and crashes the UPnP daemon. UPnP (Universal Plug and Play) is a network protocol suite common on CPE devices that enables automatic port-forwarding discovery; DeletePortMapping is a standard UPnP WANIPConnection action that removes an existing port mapping entry. The affected product - identified by CPE cpe:2.3:a:zyxel:vmg4005-b50b_firmware:*:*:*:*:*:*:*:* - is a Zyxel DSL/Ethernet customer premises equipment (CPE) device, consistent with the advisory's broader scope covering '4G/LTE, 5G NR CPE and DSL Ethernet CPE' product lines. The CVSS attack vector of AV:A (Adjacent) reflects that UPnP traffic operates over the local network segment and is not normally routable across the internet.

RemediationAI

The primary remediation is to apply the patch or firmware update identified in Zyxel's security advisory at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerabilities-in-the-upnp-function-of-certain-4g-lte-5g-nr-cpe-and-dsl-ethernet-cpe-06-02-2026; however, no specific patched firmware version number was included in the available input data, so the exact target version cannot be independently confirmed here - consult the advisory directly for the confirmed fix version before upgrading. As a compensating control where patching is not immediately possible, disabling the UPnP service entirely on the VMG4005-B50B removes the attack surface completely; the trade-off is that applications relying on automatic UPnP port-forwarding (gaming consoles, P2P clients, some VoIP adapters) will require manual port-forwarding configuration. Additionally, restricting LAN-side access to the device's UPnP port (typically UDP 1900 / SSDP and TCP 5000) via ACLs or firewall rules on upstream network equipment reduces exposure to trusted hosts only. Given the adjacent-network attack vector, ensuring that untrusted devices cannot reach the same broadcast domain as the CPE (e.g., proper VLAN segmentation for guest networks) provides a meaningful architectural mitigation.