Information Disclosure in TOZED ZLT M30s Web Management Interface
CVE-2025-15082

6.9MEDIUM

Key Information:

Vendor

Tozed

Status
Zlt M30s
Vendor
CVE Published:
25 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15082?

A vulnerability in the TOZED ZLT M30s Web Management Interface allows an attacker to manipulate the 'goformId' parameter, leading to the potential disclosure of sensitive information. This exploit can be executed remotely, posing significant risks to users. Despite early notifications, the vendor has not responded to this serious security concern, leaving systems susceptible to exploitation. Users are advised to assess their exposure and implement necessary security measures.

Affected Version(s)

ZLT M30s 1.0

ZLT M30s 1.1

ZLT M30s 1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15082 - Proof of Concept

References

https://vuldb.com/?id.338410
vdb-entrytechnical-description
https://vuldb.com/?ctiid.338410
signaturepermissions-required
https://vuldb.com/?submit.707306
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

S33K3R (VulDB User)
JSON
.
CVE-2025-15082 : Information Disclosure in TOZED ZLT M30s Web Management Interface