CVE-2025-13942: Zyxel WX5610-B0 Firmware RCE Vulnerability

CVE-2025-13942 Overview

A command injection vulnerability exists in the UPnP function of multiple Zyxel networking devices, including the EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0. This critical security flaw allows remote attackers to execute arbitrary operating system (OS) commands on affected devices by sending specially crafted UPnP SOAP requests. The vulnerability requires no authentication and can be exploited remotely over the network, making it particularly dangerous for exposed devices.

Critical Impact

Remote unauthenticated attackers can achieve full system compromise by injecting OS commands through malicious UPnP SOAP requests, potentially leading to device takeover, network infiltration, and data exfiltration.

Affected Products

• Zyxel EX3510-B0/B1 Fiber ONT Firmware
• Zyxel EX5510-B0, EX5512-T0, EX7710-B0 Fiber ONT Firmware
• Zyxel DX4510-B0/B1 DSL/Ethernet CPE Firmware
• Zyxel LTE3301-Plus and Nebula LTE3301-Plus 4G LTE CPE Firmware
• Zyxel NR7101 and Nebula NR7101 5G NR CPE Firmware
• Zyxel WX5610-B0 Wireless Extender Firmware
• Zyxel VMG4927-B50A, EMG6726-B10A Router Firmware
• Zyxel PX3321-T1, PX5301-T0, EE6510-10, EX2210-T0 Device Firmware

Discovery Timeline

• 2026-02-24 - CVE-2025-13942 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-13942

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the UPnP (Universal Plug and Play) service implementation within the affected Zyxel device firmware. UPnP is designed to allow network devices to discover each other and establish functional network services, but improper input validation in the SOAP request handling creates an exploitable attack surface.

The vulnerability allows unauthenticated remote attackers to inject arbitrary commands into the device's operating system. Since UPnP is often enabled by default on consumer and enterprise networking equipment to facilitate automatic port forwarding and device discovery, this significantly expands the potential attack surface. Successful exploitation grants attackers the ability to execute commands with the privileges of the UPnP service, which typically runs with elevated permissions on embedded Linux systems.

Root Cause

The root cause of this vulnerability stems from insufficient input sanitization in the UPnP SOAP request parser. When processing incoming UPnP requests, the firmware fails to properly neutralize special characters and command sequences before passing user-controlled data to system shell functions. This allows specially crafted input containing shell metacharacters (such as ;, |, &&, or backticks) to break out of the intended context and execute arbitrary commands on the underlying operating system.

Attack Vector

The attack is network-based and does not require any authentication or user interaction. An attacker can exploit this vulnerability by sending maliciously crafted UPnP SOAP requests to the target device. The attack can be executed from:

1. Local Network: Any device on the same network segment as the vulnerable Zyxel device can send malicious UPnP requests
2. Remote Network: If UPnP services are exposed to the internet (through misconfiguration or intentional exposure), remote attackers can directly target the device
3. Cross-Network Attack: An attacker could compromise a device on the local network first, then pivot to attack the Zyxel device via UPnP

The malicious SOAP request contains command injection payloads embedded within UPnP action parameters. When the device processes these requests, the injected commands are executed by the underlying shell, potentially allowing attackers to download and execute additional malware, establish reverse shells, modify device configurations, or pivot to other network resources.

Detection Methods for CVE-2025-13942

Indicators of Compromise

• Unusual outbound connections from Zyxel devices to unknown external IP addresses
• Unexpected processes or services running on affected devices
• Modified configuration files or unauthorized administrative accounts
• Anomalous UPnP traffic patterns with malformed or suspicious SOAP requests
• Log entries showing command execution attempts or shell spawning events

Detection Strategies

• Monitor network traffic for suspicious UPnP SOAP requests containing shell metacharacters such as ;, |, &&, $(), or backticks
• Implement network-based intrusion detection rules to identify command injection patterns in UPnP traffic
• Enable logging on affected devices and review for unauthorized access or unusual administrative actions
• Deploy network traffic analysis tools to baseline normal UPnP behavior and alert on deviations

Monitoring Recommendations

• Segment IoT and network infrastructure devices onto separate VLANs with strict access controls
• Implement network monitoring at the perimeter to detect any UPnP traffic attempting to egress the network
• Configure SIEM systems to correlate alerts from multiple sources when suspicious activity involves Zyxel devices
• Regularly audit device configurations and compare against known-good baselines

How to Mitigate CVE-2025-13942

Immediate Actions Required

• Apply the latest firmware updates from Zyxel as referenced in the Zyxel Security Advisory
• Disable UPnP functionality on affected devices if not required for operations
• Ensure affected devices are not directly exposed to the internet
• Implement network segmentation to isolate vulnerable devices from critical network resources
• Review device access logs for any signs of prior exploitation

Patch Information

Zyxel has released security patches addressing this vulnerability. Administrators should consult the Zyxel Security Advisory for specific firmware versions and download links for each affected product. Due to the critical nature of this vulnerability and the lack of authentication requirements, organizations should prioritize patching these devices immediately.

Workarounds

• Disable UPnP services on affected devices through the administrative interface until patches can be applied
• Block UPnP traffic (typically UDP ports 1900 and TCP ports 2869, 5000) at network firewalls
• Restrict network access to affected devices using firewall rules or access control lists
• Consider deploying a network-based web application firewall or IPS with signatures for command injection attacks

# Example: Blocking UPnP traffic at the network perimeter using iptables
# Block SSDP discovery traffic
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A OUTPUT -p udp --dport 1900 -j DROP

# Block common UPnP service ports
iptables -A INPUT -p tcp --dport 2869 -j DROP
iptables -A INPUT -p tcp --dport 5000 -j DROP