CVE-2025-13942
Published: 24 February 2026
Summary
CVE-2025-13942 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zyxel Px3321-T1 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the command injection vulnerability by identifying, testing, and applying firmware patches as issued in the Zyxel security advisory.
Implements input validation mechanisms on UPnP SOAP requests to block specially crafted payloads that enable command injection.
Restricts or disables the nonessential UPnP function on the device to eliminate the attack surface for remote command injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote unauthenticated exploitation of a public-facing UPnP service (T1190) leading to arbitrary OS command execution on a likely Unix/Linux-based network device (T1059.004).
NVD Description
A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.
Deeper analysisAI
CVE-2025-13942 is a command injection vulnerability (CWE-78) in the UPnP function of Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0. Published on 2026-02-24, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its potential for high-impact confidentiality, integrity, and availability effects.
A remote, unauthenticated attacker can exploit the vulnerability by sending specially crafted UPnP SOAP requests to an affected device, enabling arbitrary operating system command execution. The attack requires no privileges, low complexity, or user interaction, making it highly accessible over the network.
Zyxel has issued a security advisory addressing this command injection vulnerability alongside null pointer dereference issues in certain 4G LTE, 5G NR CPE, DSL Ethernet CPE, fiber ONTs, security routers, and wireless extenders, available at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026.
Details
- CWE(s)