CVE-2025-14126
BaseFortify
Publication date: 2025-12-06
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tozed | zlt_m30s_pro | 3.09.06 |
| tozed | zlt_m30s | 1.47 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-259 | The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. |
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Web Interface component of TOZED ZLT M30S and ZLT M30S PRO devices (versions 1.47/3.09.06). It involves manipulation that leads to hard-coded credentials being exposed or used. The attack must be initiated from within the local network. The vulnerability has been publicly disclosed and the vendor did not respond to the disclosure.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the affected devices via hard-coded credentials, potentially allowing an attacker on the local network to fully compromise the device's confidentiality, integrity, and availability. This could result in loss of control over the device and exposure of sensitive information.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the web interface of the affected TOZED ZLT M30S and ZLT M30S PRO devices on the local network using the hard-coded credentials: username "guest" and password "123456". Since the web interface allows administrative access with these credentials, a simple test is to try logging in via a web browser or using command-line tools like curl or wget to verify access. For example, you can use the following command to test login via curl: curl -u guest:123456 http://<device-ip>/admin Replace <device-ip> with the IP address of the device. Successful authentication indicates the presence of the vulnerability. [2]
What immediate steps should I take to mitigate this vulnerability?
There are no known patches or countermeasures available from the vendor, as they did not respond to the disclosure. Immediate mitigation steps include replacing the affected TOZED ZLT M30S and ZLT M30S PRO devices with alternative products that are not vulnerable. Additionally, restrict access to the local network where these devices reside to trusted users only, and monitor for unauthorized access attempts. Since the exploit requires local network access, network segmentation and access controls can help reduce risk. [1]