CVE-2025-1732

An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable...

PT-2024-6023 · Zyxel · Zyxel Usg Flex Series +3

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions V4.32 through V5.38 Zyxel USG FLEX series versions V4.50 through V5.38 Zyxel USG FLEX 50W series versions V4.16 through V5.38 Zyxel USG20W-VPN series versions V4.16 through V5.38 Description: The issue is related to ...

The vulnerability of microprogrammed network interface cards and Zyxel USG and Zyxel VPN devices lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code.

The vulnerability of microprogrammed network interface cards and Zyxel USG/ZXyel VPN devices exists due to the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a speciall...