CVE-2025-9133 - A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device

Back Back to CVE browser

HIGH

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device

Published Oct 21, 2025

8.1

HIGH

CVSS 3.1

EPSS 5.46%

Description

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.

Affected products

Vendor Zyxel Product ATP series firmware Default
unaffected
Affected
- versions from V4.32 through V5.40
Vendor Zyxel Product USG FLEX 50(W) series firmware Default
unaffected
Affected
- versions from V4.16 through V5.40
Vendor Zyxel Product USG FLEX series firmware Default
unaffected
Affected
- versions from V4.50 through V5.40
Vendor Zyxel Product USG20(W)-VPN series firmware Default
unaffected
Affected
- versions from V4.16 through V5.40

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Zyxel	ATP series firmware	unaffected	Affected versions from V4.32 through V5.40
Zyxel	USG FLEX 50(W) series firmware	unaffected	Affected versions from V4.16 through V5.40
Zyxel	USG FLEX series firmware	unaffected	Affected versions from V4.50 through V5.40
Zyxel	USG20(W)-VPN series firmware	unaffected	Affected versions from V4.16 through V5.40

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-35119		Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Zyxel

Published Oct 21, 2025

Updated Feb 26, 2026

Reserved Aug 19, 2025

Link CVE-2025-9133

CISA Vulnrichment

Updated Oct 22, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-9133

Red Hat

No data

ENISA EUVD

Assigner Zyxel

Published Oct 21, 2025

Updated Feb 26, 2026

Link EUVD-2025-35119

GitHub

No data