Vulnerability · Published Oct 21, 2025 · Assigned by Zyxel

CVE-2025-9133

High 8.1

In plain English

A high-severity missing authorization in ATP series firmware from Zyxel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)5.5%top 7.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.

Affected products (as reported)

Vendor	Product	Versions
Zyxel	ATP series firmware	versions from V4.32 through V5.40
Zyxel	USG FLEX series firmware	versions from V4.50 through V5.40
Zyxel	USG FLEX 50(W) series firmware	versions from V4.16 through V5.40
Zyxel	USG20(W)-VPN series firmware	versions from V4.16 through V5.40

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025 vendor-advisory