This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Zyxel ZLD fixes 2 vulnerabilities
With version 5.41, Zyxel fixes 2 vulnerabilities in Zyxel ZLD (firewall firmware). The specifically affected firewall series are ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN [1].
An authenticated remote attacker with administrator privileges can execute commands in the operating system of the affected device [1].
The vulnerability is present in products:
- Zyxel ATP; >=4.32, <5.41;
- Zyxel USG FLEX; >=4.50, <5.41;
- Zyxel USG FLEX 50(W); >=4.16, <5.41;
- Zyxel USG20(W)-VPN; >=4.16, <5.41;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-8078 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 21. 10. 2025.
A remote attacker authenticated with only one factor of two-factor authentication can obtain the configuration of the affected device [1].
The vulnerability is present in products:
- Zyxel ATP; >=4.32, <5.41;
- Zyxel USG FLEX; >=4.50, <5.41;
- Zyxel USG FLEX 50(W); >=4.16, <5.41;
- Zyxel USG20(W)-VPN; >=4.16, <5.41;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-9133 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 21. 10. 2025.
By CESNET, z.s.p.o. Martin Krajči on 21. 10. 2025.