A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Zyxel
  • Atp100
  • Atp100w
  • Atp200
  • Atp500
  • Atp700
  • Atp800
  • Atp Series Firmware
  • Usg20(w)-vpn Series Firmware
  • Usg 20w-vpn
  • Usg Flex 100
  • Usg Flex 100ax
  • Usg Flex 100w
  • Usg Flex 200
  • Usg Flex 50
  • Usg Flex 50(w) Series Firmware
  • Usg Flex 500
  • Usg Flex 50ax
  • Usg Flex 50w
  • Usg Flex 700
  • Usg Flex Series Firmware
  • Zld

Configuration 1 [-]

AND
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:usg_20w-vpn:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*

No data.

References
Link Providers
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025 cve-icon cve-icon
History

Tue, 28 Oct 2025 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel atp100
Zyxel atp100w
Zyxel atp200
Zyxel atp500
Zyxel atp700
Zyxel atp800
Zyxel usg 20w-vpn
Zyxel usg Flex 100
Zyxel usg Flex 100ax
Zyxel usg Flex 100w
Zyxel usg Flex 200
Zyxel usg Flex 50
Zyxel usg Flex 500
Zyxel usg Flex 50ax
Zyxel usg Flex 50w
Zyxel usg Flex 700
Zyxel zld
CPEs cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_20w-vpn:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
Vendors & Products Zyxel atp100
Zyxel atp100w
Zyxel atp200
Zyxel atp500
Zyxel atp700
Zyxel atp800
Zyxel usg 20w-vpn
Zyxel usg Flex 100
Zyxel usg Flex 100ax
Zyxel usg Flex 100w
Zyxel usg Flex 200
Zyxel usg Flex 50
Zyxel usg Flex 500
Zyxel usg Flex 50ax
Zyxel usg Flex 50w
Zyxel usg Flex 700
Zyxel zld

Tue, 21 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Oct 2025 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel
Zyxel atp Series Firmware
Zyxel usg20(w)-vpn Series Firmware
Zyxel usg Flex 50(w) Series Firmware
Zyxel usg Flex Series Firmware
Vendors & Products Zyxel
Zyxel atp Series Firmware
Zyxel usg20(w)-vpn Series Firmware
Zyxel usg Flex 50(w) Series Firmware
Zyxel usg Flex Series Firmware

Tue, 21 Oct 2025 02:30:00 +0000

Type Values Removed Values Added
Description A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Zyxel

Published: 2025-10-21T01:57:20.265Z

Updated: 2025-10-22T03:55:27.044Z

Reserved: 2025-08-19T01:09:14.783Z

Link: CVE-2025-9133

cve-icon Vulnrichment

Updated: 2025-10-21T13:42:46.264Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-21T03:15:36.563

Modified: 2025-10-28T19:18:15.210

Link: CVE-2025-9133

cve-icon Redhat

No data.