PT-2025-53405 · Tozed · Tozed Zlt M30S

S33K3R · Publicado 2025-12-25 · Atualizado 2026-01-20 · CVE-2025-15082

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TOZED ZLT M30s versions up to 1.47

Description A flaw exists in TOZED ZLT M30s, specifically within the Web Management Interface component. Manipulation of the goformId argument in a request to the /reqproc/proc post file can lead to information disclosure. The attack can be initiated remotely. The exploit for this issue has been publicly released. The vendor was notified but did not respond.

Recommendations Versions up to 1.47 should be updated when a fix becomes available. As a temporary workaround, consider restricting access to the /reqproc/proc post file to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Improper Access Control

Enumeração de Fraquezas

CWE-200

CWE-284

Identificadores relacionados

CVE-2025-15082

Produtos afetados

Tozed Zlt M30S

Referências · 13

• 🔥 https://hacklab.eu.org/blogs/zlt_m30s_information_disclosure · Exploit
• 🔥 https://youtu.be/u_H29UdiPOc · Exploit
• https://t.me/CVEtracker/40664 · Publicação no Telegram
• https://vuldb.com/?id.338410 · Nota
• https://vuldb.com/?submit.707306 · Nota
• https://twitter.com/CVEnew/status/2004294846937276868 · Publicação no Twitter
• https://twitter.com/vuldb/status/2004503846102667752 · Publicação no Twitter
• https://vuldb.com/?ctiid.338410 · Nota
• https://twitter.com/VulmonFeeds/status/2004245999682740587 · Publicação no Twitter
• https://t.me/cveNotify/146829 · Publicação no Telegram
• https://t.me/cveNotify/149325 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-15082 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-15082 · Nota de Segurança