7.2

CVE-2025-6265

A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zyxel ≫ Nwa50ax Firmware Version <= 7.10\(abyw.1\)
   Zyxel ≫ Nwa50ax Version-
Zyxel ≫ Nwa50ax Pro Firmware Version <= 7.10\(acge.2\)
   Zyxel ≫ Nwa50ax Pro Version-
Zyxel ≫ Nwa55axe Firmware Version <= 7.10\(abzl.1\)
   Zyxel ≫ Nwa55axe Version-
Zyxel ≫ Nwa90ax Firmware Version <= 7.10\(accv.1\)
   Zyxel ≫ Nwa90ax Version-
Zyxel ≫ Nwa90ax Pro Firmware Version <= 7.10\(acgf.2\)
   Zyxel ≫ Nwa90ax Pro Version-
Zyxel ≫ Nwa110ax Firmware Version <= 7.10\(abtg.1\)
   Zyxel ≫ Nwa110ax Version-
Zyxel ≫ Nwa130be Firmware Version <= 7.10\(acil.2\)
   Zyxel ≫ Nwa130be Version-
Zyxel ≫ Nwa210ax Firmware Version <= 7.10\(abtd.1\)
   Zyxel ≫ Nwa210ax Version-
Zyxel ≫ Nwa220ax-6e Firmware Version <= 7.10\(acco.1\)
   Zyxel ≫ Nwa220ax-6e Version-
Zyxel ≫ Nwa1123ac Pro Firmware Version <= 6.28\(abhd.3\)
   Zyxel ≫ Nwa1123ac Pro Version-
Zyxel ≫ Wac500h Firmware Version <= 6.70\(abwa.6\)
   Zyxel ≫ Wac500h Version-
Zyxel ≫ Wac5302d-sv2 Firmware Version <= 6.25\(abvz.9\)
   Zyxel ≫ Wac5302d-sv2 Version-
Zyxel ≫ Wac6103d-i Firmware Version <= 6.28\(aaxh.3\)
   Zyxel ≫ Wac6103d-i Version-
Zyxel ≫ Wax300h Firmware Version <= 7.10\(achf.1\)
   Zyxel ≫ Wax300h Version-
Zyxel ≫ Wax510d Firmware Version <= 7.10\(abtf.1\)
   Zyxel ≫ Wax510d Version-
Zyxel ≫ Wax610d Firmware Version <= 7.10\(abte.1\)
   Zyxel ≫ Wax610d Version-
Zyxel ≫ Wax620d-6e Firmware Version <= 7.10\(accn.1\)
   Zyxel ≫ Wax620d-6e Version-
Zyxel ≫ Wax630s Firmware Version <= 7.10\(abzd.1\)
   Zyxel ≫ Wax630s Version-
Zyxel ≫ Wax640s-6e Firmware Version <= 7.10\(accm.1\)
   Zyxel ≫ Wax640s-6e Version-
Zyxel ≫ Wax650s Firmware Version <= 7.10\(abrm.1\)
   Zyxel ≫ Wax650s Version-
Zyxel ≫ Wax655e Firmware Version <= 7.10\(acdo.1\)
   Zyxel ≫ Wax655e Version-
Zyxel ≫ Wbe530 Firmware Version <= 7.10\(acle.2\)
   Zyxel ≫ Wbe530 Version-
Zyxel ≫ Wbe660s Firmware Version <= 7.10\(acgg.2\)
   Zyxel ≫ Wbe660s Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.316
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@zyxel.com.tw 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.