Zyxel CPE UPnP Buffer Overflow Vulnerability Advisory (CVE-2026-3870/3871)

Vulnerability Overview Zyxel has released a security advisory highlighting buffer overflow vulnerabilities in the UPnP functionality of specific 4G LTE/5G NR CPE and DSL/Ethernet CPE devices. These vulnerabilities could allow attackers to trigger temporary denial of service (DoS) conditions in a LAN/WLAN environment, affecting the UPnP functionality of the impacted devices. Scope of Impact CVE-2026-3870 Affected Products: DSL/Ethernet CPE Affected Models: VMG4005-B50B Affected Versions: 5.13(ABRL.5.4)C0 and earlier Patch Availability: 5.13(ABRL.5.5)C0 CVE-2026-3871 Affected Products: 4G LTE/5G NR CPE - Affected Models: NR7101 - Affected Versions: 1.00(ABUV.11)C0 and earlier - Patch Availability: 1.00(ABUV.12)B4 - Affected Models: Nebula LTE3301-PLUS - Affected Versions: 1.18(ACCA.6)C0 and earlier - Patch Availability: 1.18(ACCA.8)V0 - Affected Models: Nebula NR7101 - Affected Versions: 1.16(ACCC.3)C0 and earlier - Patch Availability: 1.16(ACCC.3)V0 Affected Products: DSL/Ethernet CPE - Affected Models: VMG4005-B50B - Affected Versions: 5.13(ABRL.5.4)C0 and earlier - Patch Availability: 5.13(ABRL.5.5)C0 Remediation Users should install the specific firmware versions released by Zyxel to address these buffer overflow vulnerabilities. The specific patch versions are as follows: CVE-2026-3870: 5.13(ABRL.5.5)C0 CVE-2026-3871: - NR7101: 1.00(ABUV.12)B4 - Nebula LTE3301-PLUS: 1.18(ACCA.8)V0 - Nebula NR7101: 1.16(ACCC.3)V0 - VMG4005-B50B: 5.13(ABRL.5.5)C0 For devices obtained through an ISP, users are advised to contact their ISP’s support team. For self-purchased devices, users are recommended to contact Zyxel support or visit the Zyxel community for further assistance. Additional Information Reporter: McGulay Hudson from watchTowr Publication Date: 2026-06-02 No proof-of-concept (PoC) code or exploit code is included in the advisory.

Goal Reached Thanks to every supporter — we hit 100%!

Zyxel CPE UPnP Buffer Overflow Vulnerability Advisory (CVE-2026-3870/3871)