CVE-2025-1732

CWE-269 — Improper Privilege Management3 documents3 sources

Severity

6.7MEDIUM

EPSS

0.1%

top 76.55%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zyxel USG Flex H Series UOS Firmware Zyxel UOS

Timeline

PublishedApr 22

Description

An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5zyxel/usg_flex_h_series_uos_firmwareV1.31

▶NVDzyxel/uos1.31

🔴Vulnerability Details

CVEList

CVE-2025-1732: An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1↗2025-04-22

▶

GHSA

GHSA-7wf3-pq8r-xwwq: An improper privilege management vulnerability in the recovery function of the USG FLEX H series uOS firmware version V1↗2025-04-22

▶