CVE-2025-1731

HIGH

Zyxel uOS 1.20-1.31 - Authenticated Privilege Escalation via PostgreSQL Command Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-1731. PoCs published by Marco Ivaldi.

AI-analyzed exploit summary This exploit leverages a symbolic link vulnerability in the setuid root binary `/usr/sbin/fermion-wrapper` on Zyxel USG FLEX H series devices. By creating a symlink in `/tmp`, the exploit overwrites `/etc/cron.d/runme` to spawn a root shell in `/tmp/pwned` after one hour.

Description

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.

Exploits (1)

exploitdb WORKING POC

by Marco Ivaldi · localmultiple

https://www.exploit-db.com/exploits/52293

View Code ZIP pw:eip

This exploit leverages a symbolic link vulnerability in the setuid root binary `/usr/sbin/fermion-wrapper` on Zyxel USG FLEX H series devices. By creating a symlink in `/tmp`, the exploit overwrites `/etc/cron.d/runme` to spawn a root shell in `/tmp/pwned` after one hour.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: Zyxel uOS V1.31 (USG FLEX H series)

Auth required

Prerequisites: Local shell access · Presence of `/usr/sbin/fermion-wrapper` with setuid root · Write access to `/tmp`

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548.001 - Setuid and Setgid

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Mailing List

http://seclists.org/fulldisclosure/2025/Apr/27

Vendor Advisory vendor-advisory

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025

Scores

CVSS v3 7.8

EPSS 0.0093

EPSS Percentile 55.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-732

Status published

Products (1)

zyxel/uos 1.20 - 1.32

Published Apr 22, 2025

Tracked Since Feb 18, 2026