A buffer overflow in the UPnP DeletePortMapping command on certain Zyxel routers can cause a temporary denial of service to the UPnP functionality. An attacker who can send a crafted request to the affected device may crash the UPnP process, leaving the user unable to create or delete port mappings until the service is restarted or the device is rebooted. This flaw specifically exploits a memory‑sanitization failure related to CWE‑120.

Zyxel VMG4005‑B50B firmware versions 5.13(ABRL.5.4)C0 and older. The vulnerability is present in the UPnP implementation of these firmware releases.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not currently widely exploited. The likely attack vector is local or adjacent, as UPnP normally accepts requests from devices on the same network. An attacker who has network access to the router could send the malicious DeletePortMapping request and trigger the DoS. The lack of a public exploit and limited exposure reduce the immediate threat, but the impact on network connectivity makes mitigation advisable.