OS Command Injection in ZyXEL Communications Corp. products - CVE-2025-13942

Vulnerability identifier: #VU123166

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2025-13942

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: ZyXEL Communications Corp.

Affected software:
LTE3301-PLUS
NR7101
Nebula NR7101
DX4510-B0
Nebula LTE3301-PLUS
DX4510-B1
EE6510-10
EX2210-T0
EX3510-B1
EX5512-T0
EX7710-B0
PX3321-T1
PX5301-T0
WX5610-B0
EMG6726-B10A
EX3510-B0
EX5510-B0
VMG4927-B50A

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the UPnP function. A remote unauthenticated attacker can send specially crafted UPnP SOAP requests and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026