OS Command Injection in ZyXEL Communications Corp. products - CVE-2025-13942

Vulnerability identifier: #VU123166

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-13942

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the UPnP function. A remote unauthenticated attacker can send specially crafted UPnP SOAP requests and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

EMG6726-B10A
VMG4927-B50A
EX5510-B0
EX3510-B0
EX7710-B0
EX5512-T0
EX3510-B1
PX3321-T1
EX2210-T0
PX5301-T0
EE6510-10
DX4510-B1
Nebula LTE3301-PLUS
WX5610-B0
LTE3301-PLUS
DX4510-B0
Nebula NR7101
NR7101

Install updates from vendor's website.

EMG6726-B10A - update to 5.13(ABNP.8.2)C1
EX7710-B0 - update to 5.18(ACAK.1.6)C0
VMG4927-B50A - update to 5.13(ABLY.10.2)C0
EX5512-T0 - update to 5.70(ACEG.5.4)C0
EX5510-B0 - update to 5.17(ABQX.11.1)C0
EX3510-B1 - update to 5.17(ABUP.15.2)C0
LTE3301-PLUS - update to 1.00(ABQU.9)C0
EX3510-B0 - update to 5.17(ABUP.15.2)C0
PX3321-T1 - addressed in versions 5.44(ACJB.1.5)C0, 5.44(ACHK.3)C0
EX2210-T0 - update to 5.50(ACDI.2.4)C0
PX5301-T0 - update to 5.44(ACKB.0.6)C0
EE6510-10 - update to 5.19(ACJQ.4.1)C0
DX4510-B1 - update to 5.17(ABYL.10.1)C0
DX4510-B0 - update to 5.17(ABYL.10.1)C0
Nebula LTE3301-PLUS - update to 1.18(ACCA.6)V0
WX5610-B0 - update to 5.18(ACGJ.0.5)C0

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

• OS Command Injection in Zyxel products