CVE-2025-1732 is an improper privilege management vulnerability affecting Zyxel USG FLEX H series uOS firmware versions V1.31 and earlier. An authenticated local attacker with administrator privileges can exploit this flaw by uploading a crafted configuration file during the recovery process to escalate privileges on the device. With a CVSS score of 6.7 (Medium), this vulnerability has a local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage for this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.31CPE matchmatch criteria | cpe:2.3:o:zyxel:uos:1.31:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Zyxel security advisory for incorrect permission assignment and improper privilege management vulnerabilities in USG FLEX H series firewalls
Apr 22, 2025Zyxel security advisory for incorrect permission assignment and improper privilege management vulnerabilities in USG FLEX H series firewalls
Apr 22, 2025