What is the CVSS score of CVE-2025-11730?

CVE-2025-11730 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of DNS are affected by CVE-2025-11730?

A command injection vulnerability in Zyxel network security appliances (ATP, USG FLEX, USG20-VPN series) allows authenticated administrators to execute unauthorized operating system commands.

How to fix or mitigate CVE-2025-11730?

Within 24 hours: Inventory all affected Zyxel devices and document firmware versions; restrict administrative access to essential personnel and review recent admin activity logs. Within 7 days: Implement network segmentation to limit lateral movement from compromised devices; disable DDNS functionality if not operationally required. Within 30 days: Contact Zyxel support for patch availability timeline; evaluate migration to patched firmware versions immediately upon release or consider replacement devices if patches are not forthcoming.

DNS CVE-2025-11730

HIGH

OS Command Injection (CWE-78)

2026-02-05 security@zyxel.com.tw

Command Injection DNS Zyxel

7.2

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 05, 2026 - 02:15 nvd

HIGH 7.2

DescriptionNVD

A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command.

AnalysisAI

Technical ContextAI

Classified as CWE-78 (OS Command Injection). A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by su

Affected ProductsAI

A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-11730 vulnerability details – vuln.today

Back

DNS CVE-2025-11730

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code