Huawei Zero-Day Flaw Causes Telecom Outage in Luxembourg

Severity: High (Score: 60.8)

Sources: Technadu, Scworld, Securityaffairs.Co

Published: 2026-05-20 · Updated: 2026-05-20

Keywords: huawei, luxembourg, outage, flaw, reportedly, caused, telecom

Severity indicators: zero-day, flaw, outage

Summary

On July 23, 2025, a nationwide telecom outage in Luxembourg was attributed to a zero-day vulnerability in Huawei enterprise routers. The flaw allowed specially crafted network traffic to exploit undocumented behavior, resulting in continuous reboot loops of the routers. This incident disrupted landline, 4G, 5G, and emergency services for over three hours. Paul Rausch from POST Luxembourg confirmed that the attack was not a typical DDoS and did not target POST specifically. Huawei acknowledged the attack as unprecedented and stated that no immediate fix was available. Investigators found no similar attacks occurred afterward, raising concerns about the lack of public disclosure and potential exposure of similar systems. No CVE or advisory has been issued regarding this vulnerability. Key Points: • A zero-day vulnerability in Huawei routers caused a nationwide telecom outage in Luxembourg. • The outage lasted over three hours, affecting all communication services including emergency lines. • Huawei has not provided a patch or public disclosure for the undocumented flaw.

Detailed Analysis

**Impact** The outage affected Luxembourg’s nationwide telecom infrastructure on July 23, 2025, disrupting landline, 4G, 5G, and emergency services for over three hours. The incident impacted POST Luxembourg’s network devices, causing significant operational downtime across multiple communication sectors. No data breach or loss was reported, and no criminal charges were filed. **Technical Details** The attack exploited a previously unknown zero-day vulnerability in Huawei enterprise routers via specially crafted network traffic, causing the devices to enter continuous reboot loops. This was not a volumetric DDoS or targeted attack, but leveraged an undocumented failure mode in the routers. No CVE or public advisory has been issued, and Huawei reported no prior similar incidents or immediate fixes. No malware or specific IOCs were disclosed. **Recommended Response** Since no patch or CVE is currently available, defenders should monitor network traffic for unusual patterns that could trigger router instability or reboot loops. Network segmentation and limiting exposure of Huawei enterprise routers to untrusted traffic are advised. Organizations should maintain communication with Huawei for updates and advisories and prepare to apply patches once released.

Source articles (3)

• Huawei zero-day flaw reportedly caused Luxembourg telecom outage | brief — Scworld · 2026-05-20
  As detailed in Security Affairs, a nationwide telecom outage in Luxembourg on July 23, 2025, was reportedly caused by an undisclosed flaw in Huawei enterprise routers. The incident disrupted landline,…
• Huawei Zero-Day Vulnerability Caused Luxembourg Telecom Outage — Technadu · 2026-05-20
  On July 23, 2025, an attack exploiting a previously unknown vulnerability in Huawei enterprise router software caused a nationwide telecommunications outage in Luxembourg. This zero-day incident sever…
• Alleged Huawei zero — Securityaffairs.Co · 2026-05-20
  A Huawei zero-day flaw reportedly caused Luxembourg’s 2025 nationwide outage, disrupting landline, 4G/5G, and emergency services On July 23, 2025, a nationwide telecom outage in Luxembourg was reporte…

Timeline

• 2025-07-23 — Nationwide telecom outage in Luxembourg: A zero-day flaw in Huawei routers caused disruptions to landline, 4G, 5G, and emergency services for over three hours.
• 2025-07-23 — POST Luxembourg confirms attack details: Paul Rausch confirmed the attack exploited undocumented behavior in Huawei routers, not a typical DDoS.
• 2025-07-23 — Huawei acknowledges unprecedented attack: Huawei stated they had not seen this attack before and had no immediate fix available.
• Recent — Concerns over lack of public disclosure: Investigators noted no CVE or advisory was issued, raising questions about similar systems' exposure.

Related entities

• Apt28 (Apt Group)
• DDoS (Attack Type)
• Zero-day Exploit (Attack Type)
• Post Luxembourg (Company)
• Luxembourg (Country)
• exploit.in (Domain)
• T1071.004 - DNS (Mitre Attack)
• Huawei Enterprise Routers (Platform)
• SOHO Routers (Platform)