Zyxel ZLD Firewalls CVE-2025-8078

Exploitation requires an authenticated session with administrator privileges on the device (PR:H), after which the attacker passes a crafted string as an argument to a CLI command to achieve OS command execution. Affected only on specific firmware ranges: Zyxel ATP (V4.32-V5.40), USG FLEX (V4.50-V5.40), USG FLEX 50(W) (V4.16-V5.40), and USG20(W)-VPN (V4.16-V5.40) running ZLD firmware; devices patched beyond these ranges or models outside this list are not affected. The primary limiting factor is the administrator-credential prerequisite - there is no unauthenticated or low-privilege path described - so realistic risk depends on credential hygiene and whether the companion 'missing authorization' vulnerability in the same advisory can be chained to reach admin-equivalent access.

This is a post-authentication OS command injection (CWE-78) that requires administrator privileges (CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH). The PR:H metric is the dominant risk-limiting factor: an attacker must already hold valid admin credentials on the firewall, which substantially narrows the realistic threat to credential theft, insider misuse, or chaining with a separate authentication-bypass/authorization flaw. Notably, the single referenced Zyxel advisory covers 'post-authentication command injection AND missing authorization vulnerabilities' together, so operators should verify whether a companion authorization flaw in the same advisory could lower the effective privilege barrier. Signals are consistent rather than conflicting: there is no CISA KEV listing and no public exploit identified, and the EPSS score of 1.45% (73rd percentile) indicates low-to-moderate modeled exploitation probability - elevated relative to the average CVE but not indicative of mass exploitation. No SSVC decision data was provided. Net assessment: a genuinely serious flaw for defense-in-depth (admin on a perimeter firewall should not mean unrestricted root-level OS access), but a measured patch priority rather than an emergency, because exploitation is gated behind administrator authentication and no active exploitation or POC is evidenced in the provided data.

An attacker who has obtained or abused Zyxel firewall administrator credentials (e.g., via phishing, reused/default credentials, or a chained authorization bypass) logs into the device's CLI and submits a crafted string as an argument to a vulnerable CLI command. The injected string breaks out of the intended command context and executes arbitrary OS commands on the underlying ZLD firmware, giving the attacker control over the perimeter appliance. No public exploit was identified at the time of analysis, and no user interaction beyond the attacker's own authenticated session is required.