CVE-2025-14105

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-05

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability was determined in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. This impacts an unknown function of the file /reqproc/proc_post of the component Web Interface. Executing manipulation of the argument goformId with the input REBOOT_DEVICE can lead to denial of service. The attack can only be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-05

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-12-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14105

EUVD

EUVD-2025-201494

Affected Vendors & Products

Vendor	Product	Version / Range
tozed	zlt_m30s_pro	3.09.06
tozed	zlt_m30s	1.47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the TOZED ZLT M30S and ZLT M30S PRO devices, specifically in the web interface component at the file /reqproc/proc_post. Manipulating the argument 'goformId' with the input 'REBOOT_DEVICE' can cause a denial of service. The attack can only be performed from within the local network, and the exploit has been publicly disclosed.

Impact Analysis

The vulnerability can lead to a denial of service condition on the affected devices, potentially causing them to reboot or become unavailable. This could disrupt normal operations or services relying on these devices within the local network.

Detection Guidance

This vulnerability can be detected by sending a crafted POST request to the device's /reqproc/proc_post endpoint with the parameter goformId=REBOOT_DEVICE from within the local network. A suggested command to test for the vulnerability is using curl: curl -X POST http://<device-ip>/reqproc/proc_post -d 'goformId=REBOOT_DEVICE'. If the device reboots or becomes unavailable, it is vulnerable. [1]

Mitigation Strategies

Immediate mitigation steps include restricting access to the device's web interface to trusted users within the local network, monitoring for suspicious POST requests to /reqproc/proc_post with goformId=REBOOT_DEVICE, and considering replacing the affected devices with alternative products, as no patches or countermeasures are currently available. [2]

Hi! I’m here to help you understand CVE-2025-14105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70