Skip to content
Fencer Vulns
high 7.8

CVE-2025-1731 json

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20…

published 2025-04-22 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-12140

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
1
Exploit-DB

Summary

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.

Patch / fix

  • zyxel uos 1.32

Timeline

  1. Published
  2. First public exploit (EDB-52293)

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52293 Zyxel USG FLEX H series uOS 1.31 - Privilege Escalation local, 2025-05-18

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Zyxel USG FLEX H series uOS firmware

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.