Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on the affected device by passing a crafted string as an argument to a CLI command.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 17 products
| Date | Total | Labels |
|---|
| 2026-02-18 | 1 | PoC1 |
| 2026-09-22 | 1 | Active Exploitation1 |
CVE-2025-8078: Remote Code Execution via CLI Command Injection #CVE20258078 #RemoteCodeExecution #CommandInjection #ZYXEL #Exploit https://rainpwn.blog/blog/cve-2025-8078/
Post summary
A blog post link about CVE‑2025‑8078 is provided, highlighting a remote code execution vulnerability via CLI command injection in ZYXEL devices, but no active exploitation, patch, or detailed exploit tool is mentioned.
Kids, that little Zyxel GS1900 under the desk? CISA put CVE-2025-8078 on the KEV list yesterday. Stack overflow in the web CGI. No login needed if you're already on the LAN. GreyNoise saw nearly a thousand of them drained across 48 countries. Patch the firmware. Those switches are not furniture. Mmkay. https://www.cisa.gov/news-events/alerts/2025/08/13/cisa-adds-three-known-exploited-vulnerabilities-catalog
Post summary
The text reports that CVE-2025-8078 is on CISA's Known Exploited Vulnerabilities list, with evidence of active exploitation observed by GreyNoise, and advises patching the firmware.
17 of 17 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | zyxel | atp100 | - | - | - |
| HW | zyxel | atp100w | - | - | - |
| HW | zyxel | atp200 | - | - | - |
| HW | zyxel | atp500 | - | - | - |
| HW | zyxel | atp700 | - | - | - |
| HW | zyxel | atp800 | - | - | - |
| HW | zyxel | usg_20w-vpn | - | - | - |
| HW | zyxel | usg_flex_100 | - | - | - |
| HW | zyxel | usg_flex_100ax | - | - | - |
| HW | zyxel | usg_flex_100w | - | - | - |
| HW | zyxel | usg_flex_200 | - | - | - |
| HW | zyxel | usg_flex_50 | - | - | - |
| HW | zyxel | usg_flex_500 | - | - | - |
| HW | zyxel | usg_flex_50ax | - | - | - |
| HW | zyxel | usg_flex_50w | - | - | - |
| HW | zyxel | usg_flex_700 | - | - | - |
| OS | zyxel | zld | - | - | - |