Is CVE-2026-3870 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3870 being exploited in the wild.

How severe is CVE-2026-3870?

Medium severity, with a CVSS score of 6.5, published 2 June 2026.

Which products and versions are affected?

Zyxel VMG4005-B50B through 5.13(ABRL.5.4)C0.

Is there a fix for CVE-2026-3870?

A patch was published on 2026-06-02: Firmware version 5.13(ABRL.5.5)C0 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3870 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-3870?

Check whether you run Zyxel VMG4005-B50B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3870: Zyxel VMG4005-B50B buffer overflow in UPnP AddPortMapping

CVE-2026-3870 · Severity: medium · CVSS 6.5 · Published 2026-06-02

A security vulnerability has been identified in Zyxel VMG4005-B50B modems, which are used to provide high-speed internet connectivity. An attacker on the same local network could exploit this flaw to crash the device's port-mapping functionality, preventing applications from automatically configuring network access. While this causes a temporary disruption to specific network features, the device's primary ability to route general internet traffic remains functional.

Technologies: Zyxel VMG4005-B50B. Vendors: Zyxel.

Quick answers

Is CVE-2026-3870 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3870 being exploited in the wild.
How severe is CVE-2026-3870?: Medium severity, with a CVSS score of 6.5, published 2 June 2026.
Which products and versions are affected?: Zyxel VMG4005-B50B through 5.13(ABRL.5.4)C0.
Is there a fix for CVE-2026-3870?: A patch was published on 2026-06-02: Firmware version 5.13(ABRL.5.5)C0 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3870 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-3870?: Check whether you run Zyxel VMG4005-B50B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the UPnP AddPortMapping() command implementation within Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0. The vulnerability is caused by insufficient input validation when processing UPnP commands. An unauthenticated attacker located on the same local area network (LAN) or wireless network (WLAN) can send a specially crafted request to trigger the overflow. Successful exploitation results in a temporary denial-of-service (DoS) of the UPnP service, though the device continues to process standard network traffic. Zyxel has released firmware version 5.13(ABRL.5.5)C0 to address this issue.

Affected products

Zyxel VMG4005-B50B through 5.13(ABRL.5.4)C0

Timeline

2026-06-01: disclosed: Initial disclosure by Zyxel and NVD publication.
2026-06-02: advisory: Zyxel security advisory published.
2026-06-02: patched: Firmware version 5.13(ABRL.5.5)C0 released.

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerabilities-in-the-upnp-function-of-certain-4g-lte-5g-nr-cpe-and-dsl-ethernet-cpe-06-02-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.