CVE-2025-6265

A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.

• zyxel nwa50ax firmware (<= 7.10\(abyw.1\)) • zyxel nwa50ax pro firmware (<= 7.10\(acge.2\)) • zyxel nwa55axe firmware (<= 7.10\(abzl.1\)) • zyxel nwa90ax firmware (<= 7.10\(accv.1\)) • zyxel nwa90ax pro firmware (<= 7.10\(acgf.2\)) • zyxel nwa110ax firmware (<= 7.10\(abtg.1\)) • zyxel nwa130be firmware (<= 7.10\(acil.2\)) • zyxel nwa210ax firmware (<= 7.10\(abtd.1\)) • zyxel nwa220ax-6e firmware (<= 7.10\(acco.1\)) • zyxel nwa1123ac pro firmware (<= 6.28\(abhd.3\)) • zyxel wac500h firmware (<= 6.70\(abwa.6\)) • zyxel wac5302d-sv2 firmware (<= 6.25\(abvz.9\)) • zyxel wac6103d-i firmware (<= 6.28\(aaxh.3\)) • zyxel wax300h firmware (<= 7.10\(achf.1\)) • zyxel wax510d firmware (<= 7.10\(abtf.1\)) • zyxel wax610d firmware (<= 7.10\(abte.1\)) • zyxel wax620d-6e firmware (<= 7.10\(accn.1\)) • zyxel wax630s firmware (<= 7.10\(abzd.1\)) • zyxel wax640s-6e firmware (<= 7.10\(accm.1\)) • zyxel wax650s firmware (<= 7.10\(abrm.1\)) • zyxel wax655e firmware (<= 7.10\(acdo.1\)) • zyxel wbe530 firmware (<= 7.10\(acle.2\)) • zyxel wbe660s firmware (<= 7.10\(acgg.2\))