CVE-2025-1731

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025	Vendor Advisory
http://seclists.org/fulldisclosure/2025/Apr/27	Mailing List

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zyxel:uos:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:zyxel:usg_flex_100h:-:::::::*
	cpe:2.3:h:zyxel:usg_flex_100hp:-:::::::*
	cpe:2.3:h:zyxel:usg_flex_200h:-:::::::*
	cpe:2.3:h:zyxel:usg_flex_200hp:-:::::::*
	cpe:2.3:h:zyxel:usg_flex_500h:-:::::::*
	cpe:2.3:h:zyxel:usg_flex_50h:-:::::::*
	cpe:2.3:h:zyxel:usg_flex_50hp:-:::::::*
	cpe:2.3:h:zyxel:usg_flex_700h:-:::::::*

History

30 Oct 2025, 17:55

Type	Values Removed	Values Added
References	() https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025 -	() https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025 - Vendor Advisory
References	~~() http://seclists.org/fulldisclosure/2025/Apr/27 -~~	() http://seclists.org/fulldisclosure/2025/Apr/27 - Mailing List
First Time		Zyxel usg Flex 50hp Zyxel usg Flex 200hp Zyxel usg Flex 100h Zyxel usg Flex 700h Zyxel uos Zyxel Zyxel usg Flex 100hp Zyxel usg Flex 200h Zyxel usg Flex 50h Zyxel usg Flex 500h
CPE		cpe:2.3:h:zyxel:usg_flex_200h:-:::::::* cpe:2.3:h:zyxel:usg_flex_50hp:-:::::::* cpe:2.3:h:zyxel:usg_flex_700h:-:::::::* cpe:2.3:h:zyxel:usg_flex_500h:-:::::::* cpe:2.3:h:zyxel:usg_flex_200hp:-:::::::* cpe:2.3:h:zyxel:usg_flex_50h:-:::::::* cpe:2.3:h:zyxel:usg_flex_100h:-:::::::* cpe:2.3:o:zyxel:uos:::::::: cpe:2.3:h:zyxel:usg_flex_100hp:-:::::::*

12 Jun 2025, 07:15

Type	Values Removed	Values Added
Summary	(en) An incorrect permission assignment vulnerability in the PostgreSQL commands of the USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.	(en) An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.

24 Apr 2025, 06:15

Type	Values Removed	Values Added
References		() http://seclists.org/fulldisclosure/2025/Apr/27 -

23 Apr 2025, 14:08

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de asignación incorrecta de permisos en los comandos PostgreSQL de las versiones de firmware uOS de la serie USG FLEX H, de la V1.20 a la V1.31, podría permitir que un atacante local autenticado con privilegios bajos acceda al shell de Linux y aumente sus privilegios mediante la creación de scripts maliciosos o la modificación de la configuración del sistema con acceso de administrador mediante un token robado. La modificación de la configuración del sistema solo es posible si el administrador no ha cerrado sesión y el token sigue siendo válido.

22 Apr 2025, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-22 03:15

Updated : 2025-10-30 17:55

NVD link : CVE-2025-1731

Mitre link : CVE-2025-1731

CVE.ORG link : CVE-2025-1731

JSON object : View

Products Affected

zyxel

usg_flex_500h
usg_flex_100h
usg_flex_100hp
usg_flex_50hp
usg_flex_200hp
usg_flex_200h
uos
usg_flex_50h
usg_flex_700h

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

7.8 /10