A critical vulnerability has been identified in Zyxel’s FLEX-H Series devices, allowing attackers to execute arbitrary database queries and achieve remote code execution without authentication.
Discovered by the researcher known as “rainpwn” and officially disclosed on April 22, 2025, this flaw leaves enterprise-grade security appliances exposed to potentially severe attacks.
The vulnerability arises from a misconfiguration in the PostgreSQL database service running on affected devices. Although PostgreSQL is typically restricted to localhost access via port 5432, attackers can bypass this restriction using SSH tunneling.
“An SSH tunnel with port forwarding exposes the database service to external access, creating a direct communication channel with the database from a remote system,” explains the researcher.
The risk is amplified by the fact that the database service does not require authentication. Once an SSH tunnel is established, an attacker can freely execute arbitrary SQL queries against the PostgreSQL instance.
The exploit specifically abuses PostgreSQL’s powerful — but risky — COPY FROM PROGRAM function, which enables the execution of system-level commands. Security researchers demonstrated this attack vector with the following code:
This straightforward query can retrieve sensitive system information, but attackers can easily modify it to spawn reverse shells or execute other malicious commands.
The PostgreSQL instance runs with sufficient privileges to enable full system-level access.
This vulnerability is part of a broader attack chain that can ultimately lead to complete system compromise. After initially gaining access as the postgres user, attackers can:
- Exploit a race condition to establish SSH tunnels, even with limited user privileges
- Steal authentication tokens from logged-in administrators
- Upload malicious files via the system’s recovery management features
- Escalate privileges to root using a specially crafted SetUID binary
“By leveraging this capability, I achieved remote code execution (RCE), successfully executing system commands to retrieve sensitive system information,” the researcher reported.
Mitigation Steps
Zyxel has assigned CVE-2025-1731 and CVE-2025-1732 to these vulnerabilities and released security patches on April 14, 2025.
Organizations using affected devices should take immediate action:
- Update firmware on all Zyxel FLEX-H Series devices to the latest version
- Implement network segmentation to tightly control management access
- Monitor SSH ports for suspicious connection attempts
- Review PostgreSQL logs for unusual or unauthorized activity
This incident underscores the critical importance of enforcing strict database access controls and authentication, even for services intended to be accessible only locally.
Organizations deploying Zyxel FLEX-H Series devices should treat this update as an urgent security priority, as exploitation tools are likely to emerge quickly following public disclosure.
