High severity7.2NVD Advisory· Published Feb 5, 2026· Updated Apr 15, 2026

CVE-2025-11730

Description

A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zyxel/ATP seriesllm-create
Range: >=V5.35, <=V5.41
Zyxel/USG FLEX seriesllm-create
Range: >=V5.35, <=V5.41
Zyxel/USG20(W)-VPN seriesllm-create
Range: >=V5.35, <=V5.41

Patches

Vulnerability mechanics

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-the-ddns-configuration-cli-command-of-zld-firewalls-02-05-2026nvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000