Zyxel USG FLEX H: local privilege escalation via incorrect permission assignment in PostgreSQL commands (CVE-2025-1731) #shorts

Summary

Welcome to our security podcast. Today we’re discussing CVE-2025-1731, a local privilege escalation vulnerability in Zyxel USG FLEX H series uOS firewall firmware. An authenticated user with low privileges can exploit incorrect permission assignments in the PostgreSQL component to gain administrator-level shell access.

Product details

The vulnerability affects Zyxel USG FLEX H series devices running uOS firmware versions from V1.20 through V1.31. These enterprise-grade firewalls are used by organizations to protect network perimeters and manage VPN connections.

Vulnerability type summary

This issue is classified under CWE-732: Incorrect Permission Assignment for a Critical Resource. It arises when the PostgreSQL command interface grants excessive permissions to low-privileged users or tokens, allowing unauthorized escalation.

Details of the vulnerability

An attacker with valid local credentials can steal or reuse an administrator’s authentication token—while the admin is still logged in—and use crafted SQL scripts or modify system configuration files to spawn a Linux shell. Because the PostgreSQL service runs with elevated privileges, the malicious commands execute as root, granting full control over the device.

Conclusion

To mitigate CVE-2025-1731, Zyxel recommends upgrading uOS firmware to V1.32 or later, which corrects permission mappings. Administrators should also enforce strict session timeouts, revoke stale tokens, and limit local management access to trusted personnel.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025
• [2025-04-23] A local privilege escalation vulnerability (CVE-2025-1731) has been discovered in Zyxel USG FLEX H Series.
• [2025-04-24] Authenticated Remote Code Execution vulnerability on USG FLEX H Series disclosed.
• [2025-04-23] Local privilege escalation vulnerability discovered in Zyxel USG FLEX H Series.