PT-2026-21643 · Zyxel · Zyxel Ex3510-B0

Published 2026-02-24 · Updated 2026-03-01 · CVE-2025-13942

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0

Description A command injection flaw exists in the UPnP function of the affected devices. This allows a remote attacker to execute operating system commands on a device by sending specially crafted UPnP SOAP requests. Exploitation typically requires both UPnP and WAN management access to be enabled. Approximately 120,000 Zyxel devices are reported as exposed online. The vulnerability allows for unauthenticated remote code execution. The API endpoint used for exploitation involves sending crafted UPnP SOAP requests. The vulnerability lies in how the system handles input to the UPnP function, potentially allowing injection of malicious commands through parameters within these requests. The vulnerable component is the UPnP service.

Recommendations Update the firmware to version 5.17(ABUP.15.1)C0 or later. Disable UPnP and WAN management access if not required.

Fix

RCE

DoS

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-02240

CVE-2025-13942

Affected Products

Zyxel Ex3510-B0

References · 30

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-13942 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13942 · Vendor Advisory
• https://twitter.com/cracbot/status/2027700456475267523 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1rf78b8/top_10_trending_cves_26022026 · Reddit Post
• https://t.me/cveNotify/152960 · Telegram Post
• https://twitter.com/cracbot/status/2028062768394645608 · Twitter Post
• https://twitter.com/CVEnew/status/2026184606362595695 · Twitter Post
• https://twitter.com/Cyber_Toolkit/status/2026655384044253238 · Twitter Post
• https://twitter.com/TechNadu/status/2027061675396886992 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2026469014906556668 · Twitter Post
• https://twitter.com/cybernewslive/status/2026830608769458652 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rfcoxa/zyxel_addresses_critical_vulnerability_in_device · Reddit Post
• https://t.me/CVEtracker/45558 · Telegram Post