« Volver al listado

CVE-2025-11730

Estado: AplazadaAlta (7.2)—

A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad post-autenticación en servicio remoto (DDNS CLI) que requiere privilegios de administrador (PR:H). Inyección de comandos OS permite ejecución remota y escalada a root/system en dispositivos Zyxel (CWE-78, vector CVSS con C:H/I:H/A:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (4)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Zyxel — ATPAIZyxel — Usg20 VPNAIZyxel — USG FlexAIZyxel — USG Flex 50AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-11730",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11730",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-06T04:55:19.377665Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zyxel.com.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@zyxel.com.tw",
      "affectedData": [
        {
          "vendor": "Zyxel",
          "product": "ATP series firmware",
          "versions": [
            {
              "status": "affected",
              "version": "versions from V5.35 through V5.41"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Zyxel",
          "product": "USG FLEX series firmware",
          "versions": [
            {
              "status": "affected",
              "version": "versions from V5.35 through V5.41"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Zyxel",
          "product": "USG FLEX 50(W) series firmware",
          "versions": [
            {
              "status": "affected",
              "version": "versions from V5.35 through V5.41"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Zyxel",
          "product": "USG20(W)-VPN series firmware",
          "versions": [
            {
              "status": "affected",
              "version": "versions from V5.35 through V5.41"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-05T02:15:52.380",
  "references": [
    {
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-the-ddns-configuration-cli-command-of-zld-firewalls-02-05-2026",
      "source": "security@zyxel.com.tw"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zyxel.com.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos de post-autenticación en el comando CLI de configuración de Dynamic DNS (DDNS) en las versiones de firmware de la serie Zyxel ATP desde V5.35 hasta V5.41, las versiones de firmware de la serie USG FLEX desde V5.35 hasta V5.41, las versiones de firmware de la serie USG FLEX 50(W) desde V5.35 hasta V5.41, y las versiones de firmware de la serie USG20(W)-VPN desde V5.35 hasta V5.41 podría permitir a un atacante autenticado con privilegios de administrador ejecutar comandos del sistema operativo (SO) en un dispositivo afectado al proporcionar una cadena especialmente diseñada como argumento al comando CLI."
    }
  ],
  "lastModified": "2026-06-17T08:31:04.703",
  "sourceIdentifier": "security@zyxel.com.tw"
}