CVE-2025-15082

TOZED ZLT M30s Web Management proc_post information disclosure

State: Published
Severity: 6.9 Medium
Published: Dec 25, 2025
Updated: Dec 26, 2025
Reserved: Dec 25, 2025

Description

A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-200 Information Disclosure
CWE-284 Improper Access Controls

Affected Products

Product	Versions
ZLT M30sTOZED	1.0Affected 1.1Affected 1.2Affected 1.3Affected 1.4Affected 1.5Affected 1.6Affected 1.7Affected 1.8Affected 1.9Affected 1.10Affected 1.11Affected 1.12Affected 1.13Affected 1.14Affected 1.15Affected 1.16Affected 1.17Affected 1.18Affected 1.19Affected 1.20Affected 1.21Affected 1.22Affected 1.23Affected 1.24Affected and 23 more versions

References

VDB-338410 | TOZED ZLT M30s Web Management proc_post information disclosurevdb-entrytechnical-description
VDB-338410 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #707306 | ZLT M30s MTNNGRM30S_1.47, M30S_1.47 (other versions might be vulnerable) Improper Access Control - Critical Information Disclosurethird-party-advisory
https://www.hacklab.eu.org/blogs/zlt_m30s_information_disclosurerelated
https://youtu.be/u_H29UdiPOcexploitmedia-coverage

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.