PT-2025-53405 · Tozed · Tozed Zlt M30S

S33K3R · Published 2025-12-25 · Updated 2026-01-20 · CVE-2025-15082

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TOZED ZLT M30s versions up to 1.47

Description A flaw exists in TOZED ZLT M30s, specifically within the Web Management Interface component. Manipulation of the goformId argument in a request to the /reqproc/proc post file can lead to information disclosure. The attack can be initiated remotely. The exploit for this issue has been publicly released. The vendor was notified but did not respond.

Recommendations Versions up to 1.47 should be updated when a fix becomes available. As a temporary workaround, consider restricting access to the /reqproc/proc post file to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200

CWE-284

Related Identifiers

CVE-2025-15082

Affected Products

Tozed Zlt M30S

References · 13

• 🔥 https://hacklab.eu.org/blogs/zlt_m30s_information_disclosure · Exploit
• 🔥 https://youtu.be/u_H29UdiPOc · Exploit
• https://osv.dev/vulnerability/CVE-2025-15082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15082 · Security Note
• https://t.me/CVEtracker/40664 · Telegram Post
• https://vuldb.com/?id.338410 · Note
• https://vuldb.com/?submit.707306 · Note
• https://twitter.com/CVEnew/status/2004294846937276868 · Twitter Post
• https://twitter.com/vuldb/status/2004503846102667752 · Twitter Post
• https://vuldb.com/?ctiid.338410 · Note
• https://twitter.com/VulmonFeeds/status/2004245999682740587 · Twitter Post
• https://t.me/cveNotify/146829 · Telegram Post
• https://t.me/cveNotify/149325 · Telegram Post