CVE-2025-13942

CRITICAL
2026-02-24 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
CVE Published
Feb 24, 2026 - 03:16 nvd
CRITICAL 9.8

Tags

Zyxel Command Injection Wx5610 B0 Firmware Ee6510 10 Firmware Px3321 T1 Firmware Lte3301 Plus Firmware Px5301 T0 Firmware Emg6726 B10a Firmware Ex5510 B0 Firmware Nebula Lte3301 Plus Firmware Ex3510 B1 Firmware Ex7710 B0 Firmware Nebula Nr7101 Firmware Dx4510 B1 Firmware Nr7101 Firmware Ex5512 T0 Firmware Dx4510 B0 Firmware Vmg4927 B50a Firmware Ex3510 B0 Firmware Ex2210 T0 Firmware

Description

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.

Analysis

Command injection in Zyxel EX3510-B0 router UPnP functionality via firmware versions through 5.17. Allows remote code execution through the UPnP service.

Technical Context

CWE-78 OS command injection through UPnP functionality. UPnP is often enabled by default and accessible from the LAN.

Affected Products

['Zyxel EX3510-B0 firmware <= 5.17(ABUP.15.1)C0']

Remediation

Update Zyxel firmware. Disable UPnP if not needed.

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +0.5
CVSS: +49
POC: 0

Share

CVE-2025-13942 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy