Is CVE-2026-3871 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3871 being exploited in the wild.

How severe is CVE-2026-3871?

Medium severity, with a CVSS score of 6.5, published 2 June 2026.

Which products and versions are affected?

Zyxel LTE3301-PLUS 1.18(ACCA.6)C0 and earlier; Zyxel NR7101 1.00(ABUV.11)C0 and earlier; Zyxel VMG4005-B50B 5.13(ABRL.5.4)C0 and earlier.

Is there a fix for CVE-2026-3871?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3871 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-3871?

Check whether you run Zyxel LTE3301-PLUS, Zyxel NR7101 or Zyxel VMG4005-B50B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3871: Zyxel multiple CPE devices buffer overflow in UPnP DeletePortMapping

CVE-2026-3871 · Severity: medium · CVSS 6.5 · Published 2026-06-02

A security vulnerability exists in several Zyxel networking devices, including certain 4G LTE, 5G, and DSL routers. An attacker on the same local network could exploit this flaw to crash the device's Universal Plug and Play (UPnP) service, which is used for automatic port discovery and configuration. While the device will continue to route general internet traffic, the UPnP feature will become unavailable until the service is restored.

Technologies: Zyxel VMG4005-B50B. Vendors: Zyxel.

Quick answers

Is CVE-2026-3871 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3871 being exploited in the wild.
How severe is CVE-2026-3871?: Medium severity, with a CVSS score of 6.5, published 2 June 2026.
Which products and versions are affected?: Zyxel LTE3301-PLUS 1.18(ACCA.6)C0 and earlier; Zyxel NR7101 1.00(ABUV.11)C0 and earlier; Zyxel VMG4005-B50B 5.13(ABRL.5.4)C0 and earlier.
Is there a fix for CVE-2026-3871?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3871 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-3871?: Check whether you run Zyxel LTE3301-PLUS, Zyxel NR7101 or Zyxel VMG4005-B50B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a classic buffer overflow (CWE-120) located within the UPnP DeletePortMapping() command handler. An unauthenticated attacker located on the same local area network (LAN/WLAN) can send a specially crafted UPnP request to trigger the overflow. Successful exploitation results in a temporary denial-of-service (DoS) specifically affecting the UPnP daemon. The device's primary packet forwarding and network traffic processing capabilities remain functional during the attack. Patches have been released for affected models, including firmware versions 5.13(ABRL.5.5)C0 for the VMG4005-B50B and 1.00(ABUV.12)B4 for the NR7101.

Affected products

Zyxel NR7101 1.00(ABUV.11)C0 and earlier
Zyxel Nebula LTE3301-PLUS 1.18(ACCA.6)C0 and earlier
Zyxel Nebula NR7101 1.16(ACCC.1)C0 and earlier
Zyxel VMG4005-B50B 5.13(ABRL.5.4)C0 and earlier

Timeline

2026-06-01: disclosed: Initial disclosure by Zyxel Corporation
2026-06-02: advisory: NVD publication date

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerabilities-in-the-upnp-function-of-certain-4g-lte-5g-nr-cpe-and-dsl-ethernet-cpe-06-02-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.