Eine Path-Traversal-Schwachstelle im file_upload-cgi CGI-Programm der Zyxel NWA50AX PRO Firmware Version 7.10(ACGE.2) und früher könnte es einem authentifizierten Angreifer mit Administratorrechten ermöglichen,

Successful exploitation of CVE-2025-6265 grants an attacker unauthorized access to specific directories on the Zyxel NWA50AX PRO device. The most concerning impact is the ability to delete files, particularly the device's configuration file. This could lead to complete device failure, requiring a factory reset and reconfiguration. Given the device's role in wireless network management, a compromised NWA50AX PRO could disrupt network connectivity and potentially expose sensitive configuration data. While the vulnerability requires administrator authentication, this highlights the importance of strong password policies and multi-factor authentication for network devices.

Organizations utilizing Zyxel NWA50AX PRO access points running firmware versions 7.10(ACGE.2) or earlier are at risk. This includes businesses relying on these access points for Wi-Fi connectivity, particularly those with limited security expertise or those who have not diligently applied firmware updates.

• zyxel: Examine access logs for unusual file upload requests containing path traversal sequences (e.g., ../). • linux / server: Use lsof to monitor file access patterns and identify any unexpected file modifications or deletions. • generic web: Monitor web server access logs for requests targeting the file_upload-cgi endpoint with suspicious parameters.

# Example: grep for path traversal attempts in access logs
grep '..\/' /var/log/nginx/access.log

1. 2025-07-15Disclosure

   disclosure

1. Reserviert2025-06-19
2. Veröffentlicht2025-07-15
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6265 is to upgrade the Zyxel NWA50AX PRO firmware to a version that includes the security patch. Monitor Zyxel's support website for the availability of the updated firmware. As a temporary workaround, restrict access to the fileupload-cgi program using firewall rules or access control lists (ACLs) to limit access to trusted administrators only. Regularly review device logs for any suspicious activity related to file uploads or deletions. After upgrading the firmware, verify the fix by attempting a path traversal attack via the fileupload-cgi program; it should be blocked.