CVE-2025-11730
A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command.
Published:Feb 5, 2026
Last Modified:Apr 15, 2026
EPS:Feb 5, 2026
EPSS Score:0.00102
CVSS Score:7.2
Affected Products
Vendor
Product
Action
Vendor
Zyxel
Product
Atp Series Firmware
Zyxel
Atp Series Firmware
Vendor
Zyxel
Product
Usg20(w)-vpn Series Firmware
Zyxel
Usg20(w)-vpn Series Firmware
Vendor
Zyxel
Product
Usg Flex 50(w) Series Firmware
Zyxel
Usg Flex 50(w) Series Firmware
Vendor
Zyxel
Product
Usg Flex Series Firmware
Zyxel
Usg Flex Series Firmware
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
