PT-2025-29534 · Zyxel · Zyxel Nwa50Ax Pro

Published 2025-07-15 · Updated 2025-07-29 · CVE-2025-6265

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NWA50AX PRO firmware versions 7.10(ACGE.2) and earlier

Description A path traversal vulnerability exists in the file upload-cgi CGI program. This could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.

Recommendations Update Zyxel NWA50AX PRO firmware to a version later than 7.10(ACGE.2).

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-09788

CVE-2025-6265

Affected Products

Zyxel Nwa50Ax Pro

References · 11

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-aps-07-15-2025 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6265 · Security Note
• https://bdu.fstec.ru/vul/2025-09788 · Security Note
• https://t.me/cvenotify/128957 · Telegram Post
• https://twitter.com/jmdevlabs/status/1950283715852075270 · Twitter Post
• https://twitter.com/autumn_good_35/status/1945112540503269601 · Twitter Post
• https://t.me/cvetracker/27839 · Telegram Post
• https://twitter.com/CVEnew/status/1944972419887763618 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1944964579479503014 · Twitter Post
• https://twitter.com/cracbot/status/1946887852434055567 · Twitter Post