Which versions of TOZED ZLT M30S are affected by CVE-2025-14126?

A HIGH severity vulnerability affecting TOZED ZLT M30S/M30S PRO devices exposes hard-coded credentials accessible through the web interface, enabling unauthorized access to network infrastructure.

How to fix or mitigate CVE-2025-14126?

Within 24 hours: inventory all TOZED ZLT M30S/M30S PRO devices in your environment and isolate them to controlled network segments. Within 7 days: implement network access controls restricting web interface access to authorized administrators only and enable enhanced monitoring of these devices. Within 30 days: evaluate replacement hardware or contact TOZED directly for patch status; if no patch emerges, prepare decommissioning timeline.

TOZED ZLT M30S CVE-2025-14126

Q: What is the CVSS score of CVE-2025-14126?

CVE-2025-14126 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-201542 HIGH

Use of Hard-coded Password (CWE-259)

2025-12-06 cna@vuldb.com

Authentication Bypass

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Mar 15, 2026 - 17:37 euvd

EUVD-2025-201542

Analysis Generated

Mar 15, 2026 - 17:37 vuln.today

CVE Published

Dec 06, 2025 - 10:16 cve.org

HIGH 7.4

CVE Published

Dec 06, 2025 - 10:16 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulation leads to hard-coded credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Hard-coded credentials in TOZED ZLT M30S and ZLT M30S PRO routers allow local network attackers to bypass authentication and gain full administrative control of the device. The vendor is unresponsive, no patch is available, and a public proof-of-concept exploit has been disclosed. Exploitation requires adjacent network access, and no active exploitation or KEV listing is reported; EPSS (0.03%) indicates very low likelihood of widespread attacks.