#VU112893 Path traversal in ZyXEL Communications Corp. products - CVE-2025-6265

Vulnerability identifier: #VU112893

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2025-6265

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
NWA50AX
NWA50AX PRO
NWA55AXE
NWA90AX
NWA90AX PRO
NWA130BE
NWA220AX-6E
WAX300H
WAX620D-6E
WAX630S
WAX640S-6E
WAX655E
WBE530
WBE660S
NWA110AX
NWA210AX
NWA1123AC PRO
WAC500H
WAC5302D-Sv2
WAC6103D-I
WAX510D
WAX610D
WAX650S

Software vendor:
ZyXEL Communications Corp.

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the file_upload-cgi CGI program. A remote administrator can access specific directories and delete files.

Install update from vendor's website.

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-aps-07-15-2025