CVE-2025-6265

Name: CVE-2025-6265
Creator: NVD / NIST
Published: 2025-07-15T02:15:28.08+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.2/10EPSS 0.51%

Last modified Jun 17, 2026

CVE-2025-6265 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.. EPSS estimates a 0.51% chance of exploitation in the next 30 days.

Description

A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.

Metrics

CVSS 3.1

7.2/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.51%

39.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Zyxel	Nwa50ax Firmware	<= 7.10\(abyw.1\)
Zyxel	Nwa50ax Pro Firmware	<= 7.10\(acge.2\)
Zyxel	Nwa55axe Firmware	<= 7.10\(abzl.1\)
Zyxel	Nwa90ax Firmware	<= 7.10\(accv.1\)
Zyxel	Nwa90ax Pro Firmware	<= 7.10\(acgf.2\)
Zyxel	Nwa110ax Firmware	<= 7.10\(abtg.1\)
Zyxel	Nwa130be Firmware	<= 7.10\(acil.2\)
Zyxel	Nwa210ax Firmware	<= 7.10\(abtd.1\)
Zyxel	Nwa220ax-6e Firmware	<= 7.10\(acco.1\)
Zyxel	Nwa1123ac Pro Firmware	<= 6.28\(abhd.3\)
Zyxel	Wac500h Firmware	<= 6.70\(abwa.6\)
Zyxel	Wac5302d-Sv2 Firmware	<= 6.25\(abvz.9\)
Zyxel	Wac6103d-I Firmware	<= 6.28\(aaxh.3\)
Zyxel	Wax300h Firmware	<= 7.10\(achf.1\)
Zyxel	Wax510d Firmware	<= 7.10\(abtf.1\)
Zyxel	Wax610d Firmware	<= 7.10\(abte.1\)
Zyxel	Wax620d-6e Firmware	<= 7.10\(accn.1\)
Zyxel	Wax630s Firmware	<= 7.10\(abzd.1\)
Zyxel	Wax640s-6e Firmware	<= 7.10\(accm.1\)
Zyxel	Wax650s Firmware	<= 7.10\(abrm.1\)
Zyxel	Wax655e Firmware	<= 7.10\(acdo.1\)
Zyxel	Wbe530 Firmware	<= 7.10\(acle.2\)
Zyxel	Wbe660s Firmware	<= 7.10\(acgg.2\)

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-aps-07-15-2025Vendor Advisory

Timeline

Published: Jul 15, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-6265?

How severe is CVE-2025-6265?

CVE-2025-6265 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 0.51% probability of exploitation in the next 30 days.

How do I fix CVE-2025-6265?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-6265?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST