CVE-2025-15082 TOZED ZLT M30s Web Management proc_post information disclosure
Remote attackers can exploit the web management interface to disclose sensitive information via the goformId argument.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15082?
CVE-2025-15082 is a medium-severity vulnerability in TOZED ZLT M30s, published on 25 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-15082?
It affects 1 product.
Products include Gztozed Zlt M30s Firmware.
How do I fix CVE-2025-15082?
No fix has been published for CVE-2025-15082 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-15082 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15082 exists.
Other vulnerabilities in TOZED ZLT M30s
Sources
Also known as GHSA-jh6h-m4rf-fh9p.