PT-2025-42827 · Zyxel · Usg Flex H Series+3

Published 2025-10-21 · Updated 2025-10-28 · CVE-2025-8078

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel ATP series versions V4.32 through V5.40 Zyxel USG FLEX series versions V4.50 through V5.40 Zyxel USG FLEX 50(W) series versions V4.16 through V5.40 Zyxel USG20(W)-VPN series versions V4.16 through V5.40

Description A post-authentication command injection issue exists in Zyxel devices. An authenticated attacker with administrator privileges can execute operating system (OS) commands on the affected device. This is achieved by providing a specially crafted string as an argument to a Command Line Interface (CLI) command. Command injection occurs when a program passes user-supplied data directly to a system shell without proper sanitization, allowing an attacker to inject arbitrary commands.

Recommendations Zyxel ATP series versions V4.32 through V5.40: Update firmware to a version beyond V5.40. Zyxel USG FLEX series versions V4.50 through V5.40: Update firmware to a version beyond V5.40. Zyxel USG FLEX 50(W) series versions V4.16 through V5.40: Update firmware to a version beyond V5.40. Zyxel USG20(W)-VPN series versions V4.16 through V5.40: Update firmware to a version beyond V5.40.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-8078

Affected Products

Usg Flex 50(W) Series

Usg Flex H Series

Usg20(W)-Vpn Series

Zyxel Atp Series

References · 14

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8078 · Security Note
• https://t.me/CVEtracker/35366 · Telegram Post
• https://t.me/secharvester/20409 · Telegram Post
• https://t.me/defcon_news/132367 · Telegram Post
• https://twitter.com/cracbot/status/1982401870758101276 · Twitter Post
• https://t.me/RNetsec/22106 · Telegram Post
• https://twitter.com/CVEnew/status/1980465473754972293 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1980480771203764572 · Twitter Post
• https://rainpwn.blog/blog/cve-2025-8078 · Reddit Post
• https://twitter.com/SecAideInfo/status/1981303658894790874 · Twitter Post
• https://t.me/cveNotify/139551 · Telegram Post
• https://t.me/cveNotify/140755 · Telegram Post