Zyxel ZLD Firewalls CVE-2025-9133

Exploitation requires the attacker to already possess valid first-factor login credentials AND requires the device to have two-factor authentication configured, since the flaw lies in authorization not being enforced at the intermediate state after the first 2FA step succeeds but before the second factor is supplied. The limiting factors are therefore: valid primary credentials are mandatory (PR:L, not unauthenticated), the management interface must be reachable by the attacker, and the 2FA workflow must be in use; it does not work against a fully unauthenticated external actor with no credentials.

This is a CWE-862 missing authorization flaw in Zyxel ZLD firewalls (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN) that lets a semi-authenticated attacker - one who has cleared only the first stage of 2FA - read and download the device's system configuration. The signals are moderately but not uniformly elevated: CVSS 8.1 with AV:N/AC:L/PR:L/UI:N indicates a low-complexity, remotely reachable attack requiring only partial authentication, and EPSS at 5.46% (93rd percentile) is notably high in relative ranking, suggesting more exploitation interest than a typical CVE. However, there is NO CISA KEV listing and NO public POC referenced, so active exploitation is not confirmed - the high EPSS percentile reflects elevated predicted likelihood, not observed in-the-wild use. A key conflict: the NVD vector asserts C:H/I:H, but the description describes only viewing/downloading configuration, which is a confidentiality-only disclosure; the I:H (integrity) rating is not supported by the described behavior and should be verified with Zyxel. Net assessment: a credible, prioritizable issue for any exposed Zyxel firewall management interface because leaked configs expose credentials, VPN secrets, and topology - but it is gated behind possession of valid first-factor credentials, making it a privilege/authorization-bypass escalation rather than a fully unauthenticated remote compromise.

An attacker who has obtained a valid first-factor username/password (e.g., via phishing, reuse, or a prior leak) authenticates to the firewall's management interface and stops after the first 2FA stage without completing the second factor. Because authorization is not enforced at that intermediate state, they invoke the configuration-retrieval function and download the full system configuration, harvesting stored credentials, VPN pre-shared keys, and network topology. No public exploit code is referenced, so this would currently require custom request crafting against the management endpoint.