CVE-2025-9133

🗓️ 21 Oct 2025 01:57:20Reported by ZyxelType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 18 Views

CVE-2025-9133: Missing authorization allows a semi-authenticated attacker after the first stage of two factor authentication to view and download the system configuration.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the microprogrammed software of Zyxel ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN lies in the absence of authentication. This allows attackers to compromise the confidentiality and integrity of the protected information.	16 Dec 202500:00	–	bdu_fstec
Circl	CVE-2025-9133	21 Oct 202505:07	–	circl
CNNVD	Zyxel ATP series firmware和Zyxel USG FLEX series firmware 安全漏洞	21 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-9133	21 Oct 202501:57	–	cvelist
EUVD	EUVD-2025-35119	21 Oct 202501:57	–	euvd
NVD	CVE-2025-9133	21 Oct 202503:15	–	nvd
OSV	CVE-2025-9133	21 Oct 202503:15	–	osv
Positive Technologies	PT-2025-42828	21 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-9133	22 Oct 202502:09	–	redhatcve
The Hacker News	⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens	27 Oct 202512:51	–	thn

NVD

Node

zyxel zldRange4.32–5.41

AND

zyxel atp100Match-

zyxel atp100wMatch-

zyxel atp200Match-

zyxel atp500Match-

zyxel atp700Match-

zyxel atp800Match-

Node

zyxel zldRange4.50–5.41

AND

zyxel usg_flex_100Match-

zyxel usg_flex_100axMatch-

zyxel usg_flex_100wMatch-

zyxel usg_flex_200Match-

zyxel usg_flex_50Match-

zyxel usg_flex_500Match-

zyxel usg_flex_50axMatch-

zyxel usg_flex_700Match-

Node

zyxel zldRange4.16–5.41

AND

zyxel usg_20w-vpn

zyxel usg_flex_50wMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "ATP series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "versions from V4.32 through V5.40"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "USG FLEX series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "versions from V4.50 through V5.40"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "USG FLEX 50(W) series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "versions from V4.16 through V5.40"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "USG20(W)-VPN series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "versions from V4.16 through V5.40"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025

17 Jun 2026 10:08Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.18.1

EPSS0.05462

SSVC

CWE-862