Vulnerability · Published Nov 9, 2025 · Assigned by VulDB

CVE-2025-12917TOZED ZLT T10 Reboot proc_post denial of service

Medium 4.3

In plain English

A medium-severity security flaw in ZLT T10 from TOZED. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 51.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04.15. The affected element is an unknown function of the file /reqproc/proc_post of the component Reboot Handler. Such manipulation leads to denial of service. Access to the local network is required for this attack to succeed. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
TOZED	ZLT T10	T10PLUS_3.04.15

Weakness: CWE-404 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References

VDB-331635 | TOZED ZLT T10 Reboot proc_post denial of service vdb-entry
VDB-331635 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #679507 | TOZED ZLT T10 PLUS (ZLT family 4G CPE) T10PLUS_3.04.15 Denial of Service third-party-advisory
https://youtu.be/3Me3wlH5cfU exploit, media-coverage
https://www.youtube.com/watch?v=3Me3wlH5cfU exploit