CVE-2025-15083lowCWE-1191

CVE-2025-15083: low-severity vulnerability in TOZED ZLT M30s

TOZED ZLT M30s UART on-chip debug and test interface with improper access control

Published · Updated

Follow this CVE+ Monitor ZLT M30s

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 1epss 0.3%
In short

The TOZED ZLT M30s device has a UART debug interface that lacks proper access controls, allowing someone with physical access to the device to potentially interact with debugging features they shouldn't be able to reach.

Technical detail

A UART interface in TOZED ZLT M30s (up to version 1.47) implements insufficient access control on on-chip debug and test functions (CWE-1191). The attack requires direct physical access to the device's UART pins and involves complex manipulation, but poses a risk if an attacker gains physical possession of the hardware.

Summary generated and translated by AI from the official description.
A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Executing manipulation can lead to on-chip debug and test interface with improper access control. The physical device can be targeted for the attack. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
TOZED · ZLT M30s
Related CVEs — TOZED ZLT M30s

In the same product, most dangerous first.

CVE-2025-15082MEDIUMTOZED ZLT M30s Web Management proc_post information disclosureEPSS 0.7%