Description
A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.
Published: 2025-07-15
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-21410 A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.
History

Wed, 14 Jan 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel nwa110ax
Zyxel nwa110ax Firmware
Zyxel nwa1123ac Pro
Zyxel nwa1123ac Pro Firmware
Zyxel nwa130be
Zyxel nwa130be Firmware
Zyxel nwa210ax
Zyxel nwa210ax Firmware
Zyxel nwa220ax-6e
Zyxel nwa220ax-6e Firmware
Zyxel nwa50ax
Zyxel nwa50ax Firmware
Zyxel nwa50ax Pro
Zyxel nwa50ax Pro Firmware
Zyxel nwa55axe
Zyxel nwa55axe Firmware
Zyxel nwa90ax
Zyxel nwa90ax Firmware
Zyxel nwa90ax Pro
Zyxel nwa90ax Pro Firmware
Zyxel wac500h
Zyxel wac500h Firmware
Zyxel wac5302d-sv2
Zyxel wac5302d-sv2 Firmware
Zyxel wac6103d-i
Zyxel wac6103d-i Firmware
Zyxel wax300h
Zyxel wax300h Firmware
Zyxel wax510d
Zyxel wax510d Firmware
Zyxel wax610d
Zyxel wax610d Firmware
Zyxel wax620d-6e
Zyxel wax620d-6e Firmware
Zyxel wax630s
Zyxel wax630s Firmware
Zyxel wax640s-6e
Zyxel wax640s-6e Firmware
Zyxel wax650s
Zyxel wax650s Firmware
Zyxel wax655e
Zyxel wax655e Firmware
Zyxel wbe530
Zyxel wbe530 Firmware
Zyxel wbe660s
Zyxel wbe660s Firmware
CPEs cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa1123ac_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa130be:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa220ax-6e:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa50ax_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa90ax_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wac5302d-sv2:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wac6103d-i:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax300h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax620d-6e:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax640s-6e:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax655e:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wbe530:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wbe660s:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa1123ac_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa130be_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa50ax_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa90ax_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac5302d-sv2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac6103d-i_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wbe530_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*
Vendors & Products Zyxel nwa110ax
Zyxel nwa110ax Firmware
Zyxel nwa1123ac Pro
Zyxel nwa1123ac Pro Firmware
Zyxel nwa130be
Zyxel nwa130be Firmware
Zyxel nwa210ax
Zyxel nwa210ax Firmware
Zyxel nwa220ax-6e
Zyxel nwa220ax-6e Firmware
Zyxel nwa50ax
Zyxel nwa50ax Firmware
Zyxel nwa50ax Pro
Zyxel nwa50ax Pro Firmware
Zyxel nwa55axe
Zyxel nwa55axe Firmware
Zyxel nwa90ax
Zyxel nwa90ax Firmware
Zyxel nwa90ax Pro
Zyxel nwa90ax Pro Firmware
Zyxel wac500h
Zyxel wac500h Firmware
Zyxel wac5302d-sv2
Zyxel wac5302d-sv2 Firmware
Zyxel wac6103d-i
Zyxel wac6103d-i Firmware
Zyxel wax300h
Zyxel wax300h Firmware
Zyxel wax510d
Zyxel wax510d Firmware
Zyxel wax610d
Zyxel wax610d Firmware
Zyxel wax620d-6e
Zyxel wax620d-6e Firmware
Zyxel wax630s
Zyxel wax630s Firmware
Zyxel wax640s-6e
Zyxel wax640s-6e Firmware
Zyxel wax650s
Zyxel wax650s Firmware
Zyxel wax655e
Zyxel wax655e Firmware
Zyxel wbe530
Zyxel wbe530 Firmware
Zyxel wbe660s
Zyxel wbe660s Firmware

Tue, 15 Jul 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00081}


Tue, 15 Jul 2025 02:00:00 +0000

Type Values Removed Values Added
Description A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}


Subscriptions

Zyxel Nwa110ax Nwa110ax Firmware Nwa1123ac Pro Nwa1123ac Pro Firmware Nwa130be Nwa130be Firmware Nwa210ax Nwa210ax Firmware Nwa220ax-6e Nwa220ax-6e Firmware Nwa50ax Nwa50ax-pro Nwa50ax-pro Firmware Nwa50ax Firmware Nwa50ax Pro Nwa50ax Pro Firmware Nwa55axe Nwa55axe Firmware Nwa90ax Nwa90ax Firmware Nwa90ax Pro Nwa90ax Pro Firmware Wac500h Wac500h Firmware Wac5302d-sv2 Wac5302d-sv2 Firmware Wac6103d-i Wac6103d-i Firmware Wax300h Wax300h Firmware Wax510d Wax510d Firmware Wax610d Wax610d Firmware Wax620d-6e Wax620d-6e Firmware Wax630s Wax630s Firmware Wax640s-6e Wax640s-6e Firmware Wax650s Wax650s Firmware Wax655e Wax655e Firmware Wbe530 Wbe530 Firmware Wbe660s Wbe660s Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: Zyxel

Published:

Updated: 2026-02-26T17:50:41.561Z

Reserved: 2025-06-19T03:32:47.838Z

Link: CVE-2025-6265

cve-icon Vulnrichment

Updated: 2025-07-15T13:23:49.678Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-15T02:15:28.080

Modified: 2026-01-14T17:48:56.863

Link: CVE-2025-6265

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-07-16T21:35:35Z

Weaknesses