Undocumented Huawei Router Flaw Linked to Luxembourg Telecom Outage
Summary
POST Luxembourg says an undocumented Huawei router behavior, triggered by specially crafted traffic, caused a nationwide outage in July 2025. The flaw has no public CVE, and its patch status remains unclear.
Key points
- POST Luxembourg's landline, 4G, and 5G services were disrupted for more than three hours on July 23, 2025.
- POST said the outage involved a non-public, undocumented router behavior for which no patch was available at the time.
- Investigators said corrupted data relayed through POST caused systems to stop and reboot; the article reports no evidence the attack specifically targeted POST.
- The traffic reportedly sent Huawei enterprise routers into a continuous restart loop, disrupting emergency communications.
- Authorities and Huawei held technical meetings, and Luxembourg notified partner incident response teams in Europe.
- No public CVE has been filed, and it remains unclear whether the flaw was fully patched or whether other operators remain exposed.
Article Details
- Victim Organization
- POST Luxembourg
- Incident Type
- Denial-of-service attack exploiting a previously unknown vulnerability in Huawei enterprise router software. Specially crafted network traffic caused routers to enter a continuous restart loop.
- Incident Date
- 2025-07-23
- Operational Impact
- POST Luxembourg's landline, 4G, and 5G mobile networks were disrupted for more than three hours, potentially preventing hundreds of thousands of residents from contacting emergency services. After connectivity was restored, the emergency call center received hundreds of additional calls.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Anne JungSpokesperson for Luxembourg’s High Commission for National Protection; discussed technical meetings between Luxembourg authorities and Huawei following the incident.Paul RauschHead of communications at POST Luxembourg; described the incident as a denial-of-service attack and confirmed it exploited undocumented behavior for which no patch was available at the time.