CVE-2025-8078

HighCVSS 7.2

Published: 21/10/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.45%

73th percentile - higher than 73% of all known CVEs

Summary

A post-authentication command injection vulnerability in Zyxel ATP series (V4.32–V5.40), USG FLEX series (V4.50–V5.40), USG FLEX 50(W) series (V4.16–V5.40), and USG20(W)-VPN series (V4.16–V5.40) could allow an authenticated attacker with administrator privileges to execute OS commands by passing a crafted string as an argument to a CLI command.

Risk Assessment

An attacker with administrator privileges could execute arbitrary commands on the system, potentially leading to full device compromise and further network escalation.

Recommendation

Update the firmware to the latest patched version and restrict administrative access to trusted networks.

Other vulnerabilities in Zyxel ATP/USG FLEX/USG20(W)-VPN firmware

CVE-2025-9133High
A missing authorization vulnerability in Zyxel ATP (V4.32–V5.40), USG FLEX (V4.50–V5.40), USG FLEX 50(W) (V4.16–V5.40), and USG20(W)-VPN (V4.16–V5.40) firmware allows a semi-authenticated attacker who has completed only the first stage of 2FA to view and download the system configuration.

Original NVD description (English source)

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on the affected device by passing a crafted string as an argument to a CLI command.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS