CVE-2025-13942

Published: Feb 24, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.

Affected (19)

Products: Zyxel: Wx5610 B0 Firmware, Lte3301 Plus Firmware, Nebula Lte3301 Plus Firmware, Nr7101 Firmware, Nebula Nr7101 Firmware, Dx4510 B0 Firmware, Dx4510 B1 Firmware, Ee6510 10 Firmware, Emg6726 B10a Firmware, Ex2210 T0 Firmware, Ex3510 B0 Firmware, Ex3510 B1 Firmware, Ex5510 B0 Firmware, Ex5512 T0 Firmware, Ex7710 B0 Firmware, Vmg4927 B50a Firmware, Px3321 T1 Firmware, Px5301 T0 Firmware

Zyxel

18 products

Wx5610 B0 Firmware

Lte3301 Plus Firmware

Nebula Lte3301 Plus Firmware

Nr7101 Firmware

Nebula Nr7101 Firmware

Dx4510 B0 Firmware

Dx4510 B1 Firmware

Ee6510 10 Firmware

Emg6726 B10a Firmware

Vmg4927 B50a Firmware

Px3321 T1 Firmware

Px5301 T0 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx5610 B0 Firmware	Before 5.18\(acgj.0.5\)c0

Running on/with	Platform Versions
Zyxel Wx5610 B0	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte3301 Plus Firmware	Before 1.00\(abqu.9\)c0

Running on/with	Platform Versions
Zyxel Lte3301 Plus	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Lte3301 Plus Firmware	Before 1.18\(acca.6\)v0

Running on/with	Platform Versions
Zyxel Nebula Lte3301 Plus	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr7101 Firmware	Before 1.00\(abuv.12\)b2

Running on/with	Platform Versions
Zyxel Nr7101	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Nr7101 Firmware	Before 1.16\(accc.1\)v0

Running on/with	Platform Versions
Zyxel Nebula Nr7101	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx4510 B0 Firmware	Before 5.17\(abyl.10.1\)c0

Running on/with	Platform Versions
Zyxel Dx4510 B0	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx4510 B1 Firmware	Before 5.17\(abyl.10.1\)c0

Running on/with	Platform Versions
Zyxel Dx4510 B1	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ee6510 10 Firmware	Before 5.19\(acjq.4.1\)c0

Running on/with	Platform Versions
Zyxel Ee6510 10	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Emg6726 B10a Firmware	Before 5.13\(abnp.8.2\)c1

Running on/with	Platform Versions
Zyxel Emg6726 B10a	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex2210 T0 Firmware	Before 5.50\(acdi.2.4\)c0

Running on/with	Platform Versions
Zyxel Ex2210 T0	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3510 B0 Firmware	Before 5.17\(abup.15.2\)c0

Running on/with	Platform Versions
Zyxel Ex3510 B0	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3510 B1 Firmware	Before 5.17\(abup.15.2\)c0

Running on/with	Platform Versions
Zyxel Ex3510 B1	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5510 B0 Firmware	Before 5.17\(abqx.11.1\)c0

Running on/with	Platform Versions
Zyxel Ex5510 B0	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5512 T0 Firmware	Before 5.70\(aceg.5.4\)c0

Running on/with	Platform Versions
Zyxel Ex5512 T0	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex7710 B0 Firmware	Before 5.18\(acak.1.6\)c0

Running on/with	Platform Versions
Zyxel Ex7710 B0	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg4927 B50a Firmware	Before 5.13\(ably.10.2\)c0

Running on/with	Platform Versions
Zyxel Vmg4927 B50a	All versions

Configuration Q

1 vulnerable

Vulnerable Software	Affected Versions
Zyxel Px3321 T1 Firmware	Before 5.44\(acjb.1.5\)c0

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Px3321 T1 Firmware	Before 5.44\(achk.3\)c0

Running on/with	Platform Versions
Zyxel Px3321 T1	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Px5301 T0 Firmware	Before 5.44\(ackb.0.6\)c0

Running on/with	Platform Versions
Zyxel Px5301 T0	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (1)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026

Source: security@zyxel.com.tw

Vendor Advisory

Timeline

No history available yet.