Which versions of TOZED ZLT M30S are affected by CVE-2025-14105?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-14105 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-14105?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

TOZED ZLT M30S CVE-2025-14105

Q: What is the CVSS score of CVE-2025-14105?

CVE-2025-14105 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-201494 LOW

Improper Resource Shutdown or Release (CWE-404)

2025-12-05 cna@vuldb.com

Denial Of Service

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Adjacent vector due to local network requirement; no privileges or user interaction; availability impact low from reboot.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201494

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

CVE Published

Dec 05, 2025 - 21:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was determined in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. This impacts an unknown function of the file /reqproc/proc_post of the component Web Interface. Executing manipulation of the argument goformId with the input REBOOT_DEVICE can lead to denial of service. The attack can only be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Denial of service in TOZED ZLT M30S and ZLT M30S PRO web interface allows unauthenticated adjacent-network attackers to reboot the device by sending a crafted request with goformId=REBOOT_DEVICE. Impacted firmware versions include 1.47 and 3.09.06. Exploit code is publicly available but no active exploitation by CISA KEV; EPSS probability is very low (0.01%).

Technical ContextAI

The vulnerability resides in the web administration interface, specifically in the /reqproc/proc_post endpoint that processes form submissions. The root cause is Improper Resource Shutdown or Release (CWE-404), where the application prematurely terminates critical processes when the goformId parameter is set to REBOOT_DEVICE without proper authentication or resource handling. CPE data from EUVD confirms the affected products are TOZED ZLT M30S (models M30S and M30S PRO) running firmware versions 1.47 and 3.09.06. The flaw is reachable over the adjacent network on the device's web service.

RemediationAI

No vendor-released patch exists as the vendor did not respond to disclosure. As a workaround, restrict access to the device's web interface at the network level: implement Layer 2 isolation (VLANs) or an adjacent firewall rule to allow only trusted management IPs to reach the web service. Disable the remote web administration feature if not strictly needed. Compensating control: deploy a network monitoring rule to alert on repeated REBOOT_DEVICE requests, though this may trigger only after the first reboot. These measures limit the attack surface but do not eliminate the flaw.