CVE-2025-15082
Information Disclosure via goformId Manipulation in TOZED ZLT M30s Web Interface
Publication date: 2025-12-25
Last updated on: 2025-12-25
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tozed | zlt_m30s | 1.47 |
| tozed | zlt_m30s | m30s_1.47 |
| tozed | zlt_m30s | mtNNGRM30S_1.47 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the TOZED ZLT M30s device firmware up to version 1.47. It exists in the Web Management Interface, specifically in the /reqproc/proc_post file. By manipulating the 'goformId' argument, an attacker can remotely cause information disclosure without authentication. This improper handling allows unauthorized actors to access sensitive information, including configuration data and administrative credentials in plaintext, leading to a breach of confidentiality. [1, 2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive device information, including administrative account credentials in plaintext. This enables an attacker to gain full access to the device's web management interface remotely without authentication, potentially compromising the device's security and control, leading to further exploitation or network compromise. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending HTTP requests to the affected device's web management interface, specifically targeting the endpoint `/reqproc/proc_post` with manipulated parameters. For example, sending a request with the parameters `isTest=false` and `goformId=export_information` without authentication can reveal sensitive information if the device is vulnerable. A simple detection command using curl would be: curl -X POST 'http://<device-ip>/reqproc/proc_post' -d 'isTest=false&goformId=export_information' If the response contains sensitive configuration data or administrative credentials in plaintext, the device is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the device's web management interface to trusted networks only, such as by using firewall rules or network segmentation. Since no vendor patch or countermeasure is available and the vendor did not respond, it is recommended to consider replacing the affected TOZED ZLT M30s device with a secure alternative. Monitoring network traffic for exploitation attempts and disabling remote management if possible are also advisable. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability leads to unauthorized disclosure of sensitive information, including administrative credentials in plaintext, which compromises confidentiality. Such information disclosure can result in non-compliance with data protection standards and regulations like GDPR and HIPAA that mandate protection of sensitive data and proper access controls. Therefore, this vulnerability negatively impacts compliance with these common standards by exposing sensitive data to unauthorized parties. [1, 2]