Introduction
Attackers who obtain valid credentials for Zyxel ATP or USG FLEX firewalls can download sensitive configuration files after passing only the first step of two-factor authentication. Those files expose network topology, VPN settings, and user data to anyone with partial access, which defeats the purpose of requiring a second factor.
About Zyxel: Zyxel is a global vendor of networking hardware, including firewalls, switches, and wireless access points. Its ATP and USG FLEX series are widely deployed in enterprise and SMB environments, and Zyxel products are used in thousands of organizations worldwide, so a flaw in these devices reaches a large number of networks.
Technical Information
CVE-2025-9133 is a missing authorization vulnerability in Zyxel ZLD firmware. It affects the authentication flow for the web management interface, and potentially other management endpoints. When a user logs in and completes only the first factor of two-factor authentication (username and password), the system creates a session object. Because of improper authorization logic, that session is not restricted as intended. The firmware does not check whether the second factor has been completed before it allows access to sensitive resources.
An attacker who has obtained valid credentials (through phishing, credential stuffing, or other means) can therefore authenticate with only the first factor and go straight to endpoints that let them view and download the full system configuration. The vulnerability is classified as CWE-862 (Missing Authorization), the category for software that fails to enforce proper authorization checks after authentication.
No public code snippets or endpoint details were available at the time of writing.
Affected Systems and Versions
The following Zyxel firewall products and firmware versions are affected:
- ATP Series: Firmware versions V4.32 through V5.40
- USG FLEX Series: Firmware versions V4.50 through V5.40
- USG FLEX 50(W) Series: Firmware versions V4.16 through V5.40
- USG20(W)-VPN Series: Firmware versions V4.16 through V5.40
Devices running these firmware versions in on-premise management mode are vulnerable. Devices managed through the Zyxel Nebula cloud platform are not affected.
Vendor Security History
Zyxel has had multiple high-impact vulnerabilities in its firewall products, including:
- CVE-2023-28771 (improper error handling, remote code execution, CVSS 9.8)
- CVE-2022-0342 (authentication bypass)
- CVE-2022-30525 (OS command injection)
- CVE-2024-11667 (directory traversal, ransomware exploitation)
The company typically releases advisories and patches in a timely manner. Even so, the repeated flaws in its authentication and authorization logic point to an ongoing weakness in how its firmware is built and reviewed for security.
