Security researchers have identified multiple vulnerabilities in Zyxel’s NWA50AX Pro WiFi 6 access points, including an unauthenticated CGI access flaw that bypasses security checks through Lighttpd web server misconfigurations.
The auth_zyxel.conf The file revealed 28 whitelisted endpoints, including /cgi-bin/file_upload-cgi, which attackers can access without valid credentials through path manipulation.
Key technical findings:
- Lighttpd’s
mod_auth_zyxelThe module failed to validate session cookies file_upload-cgiBinary contained unprotected functions for file operations- Attackers could trigger error codes like
-25001through malformed requests
text# Excerpt from auth_zyxel.conf
auth_zyxel.AuthZyxelSkipPattern = (
"/images",
"/weblogin.cgi",
"/cgi-bin/"
)
Arbitrary File Deletion via Path Traversal
The most critical vulnerability (CVE-2025-XXXXX) allows arbitrary file deletion through a crafted POST request to file_upload-cgi.
Attackers can:
- Specify
file_pathparameter with directory traversal sequences - Exploit
snprintfconcatenation vulnerability in temp file creation - Trigger
unlink()system call on targeted files
textPOST /cgi-bin/file_upload-cgi/images HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 230
file_path=/etc/passwd&file_path.filename=../../../../etc/passwd
This exploit successfully deleted the login_logo.png file from Zyxel’s web interface during testing.
Shared Codebase Risks Amplify Impact
Analysis revealed that the vulnerabilities stem from code reuse across Zyxel products, particularly components shared with NAS devices.
The file_upload-cgi binary contained similar logic to code patched in CVE-2024-29974 (Outpost24 disclosure), suggesting incomplete fixes across product lines.
Risk Factor Table
| Vulnerability | Risk Level | Description |
|---|---|---|
| Unauthenticated CGI Access | High | Bypasses authentication checks for 28 endpoints1 |
| Arbitrary File Deletion | Critical | Enables system file removal via path traversal1 |
| Cookie Validation Flaws | Medium | Relies on easily spoofed ‘authtok’ cookies1 |
| Shared Code Vulnerabilities | Medium | Affects 80% of tested devices across product lines1 |
Mitigation Recommendations:
- Immediately update to Zyxel’s latest firmware (V6.25(ABXX.1))
- Disable remote administration features
- Implement network segmentation for IoT devices
Zyxel has acknowledged these findings and plans to release patches by July 15, 20251.
Security teams should monitor authentication logs for abnormal CGI access patterns and consider temporary workarounds using web application firewalls.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The auth_zyxel.conf The file revealed 28 whitelisted endpoints, including /cgi-bin/file_upload-cgi, which attackers can access without valid credentials){kind=link}