CVE-2025-6265: Path Traversal in Zyxel NWA50AX PRO

Successful exploitation of CVE-2025-6265 allows an attacker with administrator privileges to traverse the file system of the Zyxel NWA50AX PRO device. This means they can access files outside of the intended upload directory. The most concerning impact is the ability to delete files, particularly the device's configuration file. Deletion of the configuration file could render the device inoperable, requiring a factory reset and potentially leading to data loss. Furthermore, access to other sensitive files could expose credentials or other confidential information. The blast radius is limited to the affected device, but a compromised access point could impact the network it serves.

1. Reserved2025-06-19
2. Published2025-07-15
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-6265 is to upgrade the Zyxel NWA50AX PRO firmware to a version that includes the security patch. Monitor Zyxel's support website for the availability of the updated firmware. As a temporary workaround, restrict administrator access to the file upload functionality and implement strict file type validation to prevent malicious uploads. Consider implementing network segmentation to limit the impact of a potential compromise. After upgrading, verify the integrity of the configuration file and confirm that the file upload functionality is operating as expected.