PT-2025-49359 · Tozed · Tozed Zlt M30S+1

S33K3R · Publicado 2025-12-06 · Atualizado 2025-12-11 · CVE-2025-14126

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOZED ZLT M30S versions 1.47 and 3.09.06 TOZED ZLT M30S PRO versions 1.47 and 3.09.06

Description A security issue exists in TOZED ZLT M30S and ZLT M30S PRO devices. The issue involves hard-coded credentials within an unknown function of the Web Interface component. Exploitation requires local network access. The exploit for this issue has been publicly disclosed, and the vendor has not responded to reports regarding this disclosure.

Recommendations Versions 1.47 and 3.09.06 of TOZED ZLT M30S and ZLT M30S PRO are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-259

Identificadores relacionados

CVE-2025-14126

Produtos afetados

Tozed Zlt M30S

Tozed Zlt M30S Pro

Referências · 12

• 🔥 https://youtu.be/o8rfjSlpRxY · Exploit
• https://twitter.com/cracbot/status/1999071722793050390 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1997257377565790377 · Publicação no Twitter
• https://t.me/cveNotify/145009 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-14126 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1997260931638636566 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/1997329001438671232 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1997254488738898116 · Publicação no Twitter
• https://t.me/CVEtracker/39003 · Publicação no Telegram
• https://vuldb.com/?submit.697498 · Nota
• https://vuldb.com/?id.334521 · Nota
• https://vuldb.com/?ctiid.334521 · Nota