Zyxel security advisory for post-authentication command injection and missing authorization......

Zyxel_May

Zyxel security advisory for post-authentication command injection and missing authorization vulnerabilities in ZLD firewalls

CVEs: CVE-2025-8078, CVE-2025-9133

Summary

Zyxel has released patches addressing a post-authentication command injection vulnerability and a missing authorization vulnerability in certain versions of the ZLD firewall firmware. Users are advised to install these patches promptly to ensure optimal protection.

What are the vulnerabilities?

CVE-2025-8078

The post-authentication command injection vulnerability in certain ZLD firewall versions could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on the affected device by passing a crafted string as an argument to a CLI command.

CVE-2025-9133

The missing authorization vulnerability in certain ZLD firewall versions could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period and released updates to address the vulnerabilities, as shown in the table below.

Firewall series	Affected version		Patch availability
	CVE-2025-8078	CVE-2025-9133
ATP	ZLD V4.32 to V5.40	ZLD V4.32 to V5.40	ZLD V5.41
USG FLEX	ZLD V4.50 to V5.40	ZLD V4.50 to V5.40	ZLD V5.41
USG FLEX 50(W)/ USG20(W)-VPN	ZLD V4.16 to V5.40	ZLD V4.16 to V5.40	ZLD V5.41

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.

Acknowledgment

Thanks to Alessandro Sgreccia from HackerHood for reporting the issues to us.

Revision history

2025-10-21: Initial release