Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 17 products
CVE-2025-9133: Configuration Exposure via Authorization Bypass #CVE20259133 #ZyxelVulnerability #AuthBypass #ConfigExposure #CommandInjection https://rainpwn.blog/blog/cve-2025-9133/
Post summary
CVE-2025-9133 is disclosed as a configuration exposure via authorization bypass with potential command injection, referenced via a blog post.
17 of 17 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | zyxel | atp100 | - | - | - |
| HW | zyxel | atp100w | - | - | - |
| HW | zyxel | atp200 | - | - | - |
| HW | zyxel | atp500 | - | - | - |
| HW | zyxel | atp700 | - | - | - |
| HW | zyxel | atp800 | - | - | - |
| HW | zyxel | usg_20w-vpn | - | - | - |
| HW | zyxel | usg_flex_100 | - | - | - |
| HW | zyxel | usg_flex_100ax | - | - | - |
| HW | zyxel | usg_flex_100w | - | - | - |
| HW | zyxel | usg_flex_200 | - | - | - |
| HW | zyxel | usg_flex_50 | - | - | - |
| HW | zyxel | usg_flex_500 | - | - | - |
| HW | zyxel | usg_flex_50ax | - | - | - |
| HW | zyxel | usg_flex_50w | - | - | - |
| HW | zyxel | usg_flex_700 | - | - | - |
| OS | zyxel | zld | - | - | - |