CVE-2025-3577
📋 TL;DR
This path traversal vulnerability in Zyxel AMG1302-T10B firmware allows authenticated administrators to access restricted directories via crafted HTTP requests. Only devices running firmware version 2.00(AAJC.16)C0 are affected, and the vendor has declared this product end-of-life.
💻 Affected Systems
- Zyxel AMG1302-T10B
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator could access sensitive system files, configuration data, or credentials stored in restricted directories, potentially leading to full device compromise.
Likely Case
Administrator accesses configuration files or logs that should be restricted, potentially exposing sensitive network information.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized administrators who already have high privileges.
🎯 Exploit Status
Exploitation requires administrator credentials and knowledge of the web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.zyxel.com/service-provider/global/en/security-advisories/end-of-life
Restart Required: No
Instructions:
No official patch available. Vendor has declared product end-of-life. Consider replacement or workarounds.
🔧 Temporary Workarounds
Restrict Web Interface Access
allLimit access to the web management interface to trusted networks only
Implement Network Segmentation
allIsolate affected devices in separate network segments
🧯 If You Can't Patch
- Replace affected devices with supported models
- Implement strict access controls and monitor administrator activity
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System Info > Firmware VersionCheck Version:
N/A - check via web interfaceVerify Fix Applied:
No fix available to verify. Consider device replacement.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to web interface with path traversal patterns
- Multiple failed directory access attempts
Network Indicators:
- HTTP requests containing '../' or similar path traversal patterns to device management interface
SIEM Query:
source="device_logs" AND (http_uri="*../*" OR http_uri="*..\\*" OR http_uri="*%2e%2e%2f*")