CVE-2025-15082

MediumCVSS 5.3

Published: 25/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.70%

52th percentile - higher than 52% of all known CVEs

Summary

TOZED ZLT M30s router up to version 1.47 has an information disclosure vulnerability in the web management interface, in file /reqproc/proc_post, via manipulation of the goformId argument. The attack can be performed remotely, and the exploit is public.

Risk Assessment

An attacker could obtain sensitive information about the device and network, potentially facilitating further attacks.

Recommendation

Contact the vendor for a patch. If not available, restrict access to the management interface and monitor network traffic.

Other vulnerabilities in TOZED ZLT M30s

CVE-2025-15083Low
A vulnerability in TOZED ZLT M30s up to 1.47 in the UART interface allows access to on-chip debug and test interface with improper access control. The attack requires physical access, is highly complex and difficult to exploit. The exploit has been publicly disclosed and the vendor has not responded.

Original NVD description (English source)

A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS