Skip to content

Commit f880e0f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5r6g-vjqj-7mwg GHSA-fr9h-qfx7-p4r3 GHSA-q2rh-fc48-r3gw GHSA-v223-4hv2-g25q GHSA-x52x-mhfj-w7qq GHSA-x59x-qc82-4w4p
1 parent d7d2ddb commit f880e0f

File tree

6 files changed

+262
-0
lines changed

6 files changed

+262
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-5r6g-vjqj-7mwg/GHSA-5r6g-vjqj-7mwg.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5r6g-vjqj-7mwg",
4+
"modified": "2025-10-21T03:30:16Z",
5+
"published": "2025-10-21T03:30:16Z",
6+
"aliases": [
7+
"CVE-2025-7850"
8+
],
9+
"details": "A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7850"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.omadanetworks.com/en/document/108456"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-78"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-21T01:15:37Z"
47+
}
48+
}

‎advisories/unreviewed/2025/10/GHSA-fr9h-qfx7-p4r3/GHSA-fr9h-qfx7-p4r3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fr9h-qfx7-p4r3",
4+
"modified": "2025-10-21T03:30:17Z",
5+
"published": "2025-10-21T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-8078"
8+
],
9+
"details": "A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on the affected device by passing a crafted string as an argument to a CLI command.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8078"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-21T03:15:35Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-q2rh-fc48-r3gw/GHSA-q2rh-fc48-r3gw.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q2rh-fc48-r3gw",
4+
"modified": "2025-10-21T03:30:16Z",
5+
"published": "2025-10-21T03:30:16Z",
6+
"aliases": [
7+
"CVE-2025-7851"
8+
],
9+
"details": "An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7851"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.omadanetworks.com/en/document/108456"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [],
41+
"severity": "HIGH",
42+
"github_reviewed": false,
43+
"github_reviewed_at": null,
44+
"nvd_published_at": "2025-10-21T01:15:37Z"
45+
}
46+
}

‎advisories/unreviewed/2025/10/GHSA-v223-4hv2-g25q/GHSA-v223-4hv2-g25q.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v223-4hv2-g25q",
4+
"modified": "2025-10-21T03:30:16Z",
5+
"published": "2025-10-21T03:30:16Z",
6+
"aliases": [
7+
"CVE-2025-6542"
8+
],
9+
"details": "An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6542"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.omadanetworks.com/en/document/108455"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-78"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-21T01:15:37Z"
47+
}
48+
}

‎advisories/unreviewed/2025/10/GHSA-x52x-mhfj-w7qq/GHSA-x52x-mhfj-w7qq.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x52x-mhfj-w7qq",
4+
"modified": "2025-10-21T03:30:16Z",
5+
"published": "2025-10-21T03:30:16Z",
6+
"aliases": [
7+
"CVE-2025-6541"
8+
],
9+
"details": "An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6541"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.omadanetworks.com/en/document/108455"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-78"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-21T01:15:36Z"
47+
}
48+
}

‎advisories/unreviewed/2025/10/GHSA-x59x-qc82-4w4p/GHSA-x59x-qc82-4w4p.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x59x-qc82-4w4p",
4+
"modified": "2025-10-21T03:30:18Z",
5+
"published": "2025-10-21T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-9133"
8+
],
9+
"details": "A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9133"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-21T03:15:36Z"
35+
}
36+
}

0 commit comments

Comments
 (0)