PT-2025-49313 · Tozed · Tozed Zlt M30S Pro+1

Published 2025-12-05 · Updated 2025-12-17 · CVE-2025-14105

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions TOZED ZLT M30S and ZLT M30S PRO versions 1.47/3.09.06

Description A flaw exists in the Web Interface component of TOZED ZLT M30S and ZLT M30S PRO. The issue is related to the manipulation of the goformId argument with the input REBOOT DEVICE within the '/reqproc/proc post' file. This can result in a denial of service. The attack is limited to the local network. The vulnerability has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Apply a fix or update to a version beyond 1.47/3.09.06. As a temporary workaround, restrict access to the '/reqproc/proc post' file. Avoid using the goformId parameter with the REBOOT DEVICE input.

Exploit

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2025-14105

Affected Products

Tozed Zlt M30S

Tozed Zlt M30S Pro

References · 9

• 🔥 https://youtu.be/RNgsrnPPxgQ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14105 · Security Note
• https://vuldb.com/?id.334487 · Note
• https://vuldb.com/?submit.696740 · Note
• https://twitter.com/CVEnew/status/1997056503748952565 · Twitter Post
• https://t.me/CVEtracker/38964 · Telegram Post
• https://twitter.com/Cezar_H_Linux/status/2001252082003952041 · Twitter Post
• https://vuldb.com/?ctiid.334487 · Note
• https://twitter.com/VulmonFeeds/status/1997091925183037467 · Twitter Post