CVE-2025-9133: High severity Zyxel ATP series firmware vulnerability
A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9133?
CVE-2025-9133 is classified as a critical severity vulnerability due to its potential to allow unauthorized access to sensitive functions.
How do I fix CVE-2025-9133?
To address CVE-2025-9133, upgrade the affected Zyxel firmware to the latest version available permanently rectifying the vulnerability.
What versions are affected by CVE-2025-9133?
CVE-2025-9133 affects Zyxel ATP series, USG FLEX series, USG FLEX 50(W) series, and USG20(W)-VPN series firmware within specific version ranges.
What types of devices are impacted by CVE-2025-9133?
CVE-2025-9133 impacts specific Zyxel networking devices including firewalls in their ATP series, USG FLEX series, USG FLEX 50(W), and USG20(W)-VPN series.
Is there a workaround for CVE-2025-9133?
Currently, the recommended action for CVE-2025-9133 is to update the firmware, as there is no reliable workaround to mitigate the issue.