CVE-2025-9133

HighCVSS 8.1

Published: 21/10/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.46%

93th percentile - higher than 93% of all known CVEs

Summary

A missing authorization vulnerability in Zyxel ATP (V4.32–V5.40), USG FLEX (V4.50–V5.40), USG FLEX 50(W) (V4.16–V5.40), and USG20(W)-VPN (V4.16–V5.40) firmware allows a semi-authenticated attacker who has completed only the first stage of 2FA to view and download the system configuration.

Risk Assessment

An attacker could access device configuration, potentially including sensitive network and security settings, facilitating further attacks. The risk applies to devices with 2FA enabled.

Recommendation

Update the firmware to the latest version. Consider disabling management interface access from untrusted networks.

Other vulnerabilities in Zyxel ATP/USG FLEX/USG20(W)-VPN firmware

CVE-2025-8078High
A post-authentication command injection vulnerability in Zyxel ATP series (V4.32–V5.40), USG FLEX series (V4.50–V5.40), USG FLEX 50(W) series (V4.16–V5.40), and USG20(W)-VPN series (V4.16–V5.40) could allow an authenticated attacker with administrator privileges to execute OS commands by passing a crafted string as an argument to a CLI command.

Original NVD description (English source)

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS