Une vulnérabilité de gestion de privilèges incorrecte dans la fonction de récupération du micrologiciel Zyxel USG FLEX H series uOS version V1.31 et antérieures pourrait permettre à un attaquant local authentifié disposant de droits d'administrateur

Successful exploitation of CVE-2025-1732 could allow an attacker with administrator access to gain complete control over the affected Zyxel USG FLEX H series device. This could involve modifying firewall rules, accessing sensitive data stored on the device, or using the device as a pivot point to attack other systems on the network. The impact is particularly severe because it allows privilege escalation from an already-authenticated administrator account, bypassing standard access controls. The ability to upload a crafted configuration file provides a flexible attack vector, allowing for a wide range of malicious actions.

Organizations utilizing Zyxel USG FLEX H series devices deployed in environments where local administrator access is not strictly controlled are at increased risk. Shared hosting environments where multiple users have administrator privileges on the firewall are particularly vulnerable.

• linux / server: Monitor system logs (journalctl) for unusual configuration file upload attempts. Look for patterns indicative of crafted configuration files.

journalctl -u zyxel-uos -f | grep -i 'configuration upload'

• zyxel: Check the Zyxel security advisory for specific IOCs related to the vulnerability. Monitor device logs for unauthorized configuration changes. • generic web: If the recovery function is exposed via a web interface, test for file upload vulnerabilities using standard web security testing techniques.

1. 2025-04-22Disclosure

   disclosure

1. Réservé2025-02-27
2. Publiée2025-04-22
3. Modifiée2026-02-26
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-1732 is to upgrade the Zyxel USG FLEX H series uOS firmware to a patched version. Zyxel has released firmware updates to address this vulnerability; refer to their advisory for specific version details. As a temporary workaround, restrict access to the recovery function to trusted administrators only. Consider implementing stricter file validation on uploaded configuration files to prevent malicious content from being processed. Monitor system logs for suspicious activity related to configuration file uploads.