Zyxel security advisory for post-authentication command injection vulnerability in the DDNS .....

Zyxel_May

Zyxel security advisory for post-authentication command injection vulnerability in the DDNS configuration CLI command of ZLD firewalls

CVE: CVE-2025-11730

Summary

Zyxel has released patches addressing a post‑authentication command injection vulnerability in certain versions of the ZLD firewall firmware. Users are advised to install these patches promptly to maintain optimal protection.

What is the vulnerability?

CVE-2025-11730

A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in certain versions of the ZLD firewall firmware could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command.

What versions are vulnerable—and what should you do?

After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period and released updates to address the vulnerability, as shown in the table below.

Firewall series	Affected version	Patch availability
ATP	ZLD V5.35 to V5.41	ZLD V5.42
USG FLEX	ZLD V5.35 to V5.41	ZLD V5.42
USG FLEX 50(W)/ USG20(W)-VPN	ZLD V5.35 to V5.41	ZLD V5.42

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.

Acknowledgment

Thanks to Alessandro Sgreccia from HackerHood for reporting the issue to us.

Revision history

2026-2-5:Initial release