Redazione RHC : 21 October 2025 07:36
Security researcher Alessandro Sgreccia , a member of Red Hot Cyber’s HackerHood team, has reported two new vulnerabilities to Zyxel affecting several devices from the ZLD (ATP/USG) family.
Alessandro Sgreccia ( Ethical hacker of HackerHood known for issuing various CVEs, such as the RCE CVE-2022-0342 from 9.8 on Zyxel), triggered a responsible report to Zyxel who promptly responded by fixing the issue.
Zyxel promptly analyzed the provided reports and published an official advisory confirming the flaws and indicating the affected firmware versions and the available fix releases in its security bulletin .
This vulnerability, with a CVSS v3.1 score of 8.1 (High) , involves a missing authorization issue in the handling of some requests sent to the web interface of Zyxel firewalls.
Under certain circumstances, an authenticated attacker with limited privileges may be able to access sensitive information or functions not intended for their access level.
The issue has also been classified as CWE-184 (Incomplete List of Disallowed Inputs) , as it was associated with a partial validation of the commands accepted by the system.
The second vulnerability, with a CVSS v3.1 score of 7.2 (High) , concerns a command injection found in a component of the ZLD firmware.
An authenticated user with elevated privileges could, under specific conditions, execute arbitrary commands on the device, compromising the security of the system. The bug has been classified as CWE-78 , meaning an improper bypass of special elements used in system commands.
Zyxel’s official advisory lists the affected models and releases and recommends updating to the patched versions (information on individual releases and patched builds is included in the advisory). Administrators are advised to follow the vendor’s instructions. Zyxel
HackerHood, with 15 CVEs issued in two years of operation, is Red Hot Cyber’s collective of ethical hackers committed to researching undocumented vulnerabilities to ensure stronger cybersecurity. The group is based on a manifesto that promotes knowledge sharing and improving collective security, identifying and reporting critical vulnerabilities to protect users and businesses.
According to the HackerHood manifesto , the collective values ethics in cybersecurity and encourages collaboration among professionals in the field. This case demonstrates the importance of their mission: to put the skills of ethical hackers at the service of the global community to identify as yet unknown threats.
If you’re a bug hunter or security researcher and want to contribute to initiatives like this, HackerHood is always open to new talent. The collective welcomes motivated experts to work on concrete projects to improve global cybersecurity. Send an email with your experience and skills to [email protected] to join this team of professionals.
The discovery of these two new CVEs is yet another example of HackerHood’s contribution to the international cybersecurity landscape. It is essential that businesses and end users pay attention to these discoveries and take the necessary measures to prevent potential exploits. Collaboration between ethical hackers, businesses, and communities remains a cornerstone in the fight against cyber threats.
Redazione