Cyber Resilience

CVE-2025-8078

RCE in Zyxel Zld 4.32 – 5.41

Published
21 October 2025
Modified
28 October 2025
Patch / advisory
CVSS Score v3.1 7.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.015 71th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-8078 is a high-severity OS Command Injection (CWE-78) vulnerability in Zyxel Zld. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 29% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from…

more

V4.16 through V5.40 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on the affected device by passing a crafted string as an argument to a CLI command.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Why these techniques?

Post-auth CLI command injection (CWE-78) on network devices directly enables OS command execution via Network Device CLI.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-42060Same product: Zyxel Atp100
CVE-2024-42059Same product: Zyxel Atp100
CVE-2024-42057Same product: Zyxel Atp100
CVE-2024-7203Same product: Zyxel Atp100
CVE-2025-9133Same product: Zyxel Atp100
CVE-2024-42061Same product: Zyxel Atp100
CVE-2024-42058Same product: Zyxel Atp100
CVE-2024-6343Same product: Zyxel Atp100
CVE-2024-11667Same product: Zyxel Atp100
CVE-2023-27991Same product: Zyxel Atp100

Affected Assets

zyxel
zld
4.32 — 5.41 · 4.50 — 5.41 · 4.16 — 5.41

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-2 Flaw Remediation
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.5
  • V1.2.8
  • V15.2.5

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of untrusted input to CLI commands, blocking the crafted-string OS command injection (CWE-78).

prevent

Mandates prompt application of vendor patches that remediate the post-auth command-injection flaw in the affected Zyxel firmware versions.

prevent

Enforces least functionality by disabling or restricting unnecessary CLI commands and interfaces that could be abused for OS command execution.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.

PR.PS-02 partial match
prevents

Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.

References