Huawei zero-day flaw reportedly caused Luxembourg telecom outage

As detailed in Security Affairs, a nationwide telecom outage in Luxembourg on July 23, 2025, was reportedly caused by an undisclosed flaw in Huawei enterprise routers. The incident disrupted landline, 4G/5G, and emergency services for over three hours.

The outage was triggered by specially crafted network traffic that exploited a previously unknown vulnerability in Huawei enterprise routers, forcing them into continuous reboot loops. Paul Rausch, head of communications at POST Luxembourg, confirmed the attack targeted a network device using a non-public, undocumented behavior for which no patch was available. Investigators determined it was not a typical volumetric DDoS attack and did not appear to be a targeted attack against POST Luxembourg, with no criminal charges filed.

Evidence suggests the traffic exploited an undocumented failure in the Huawei routers, causing repeated crashes. Huawei stated they had not seen the attack before and had no immediate fix, with no similar attacks observed afterward. Concerns remain about the lack of public disclosure, as no CVE or advisory was issued, leaving questions about whether similar systems are still exposed.

Source: Security Affairs