#VU123166 OS Command Injection in ZyXEL Communications Corp. products - CVE-2025-13942

Vulnerability identifier: #VU123166

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2025-13942

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
LTE3301-PLUS
NR7101
Nebula NR7101
DX4510-B0
Nebula LTE3301-PLUS
DX4510-B1
EE6510-10
EX2210-T0
EX3510-B1
EX5512-T0
EX7710-B0
PX3321-T1
PX5301-T0
WX5610-B0
EMG6726-B10A
EX3510-B0
EX5510-B0
VMG4927-B50A

Software vendor:
ZyXEL Communications Corp.

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the UPnP function. A remote unauthenticated attacker can send specially crafted UPnP SOAP requests and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026