CVE-2025-13942
Published: 24 February 2026
Summary
CVE-2025-13942 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zyxel Px3321-T1 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-13942 is a command injection vulnerability (CWE-78) in the UPnP function of Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0. Published on 2026-02-24, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its potential for high-impact confidentiality, integrity, and availability effects.
A remote, unauthenticated attacker can exploit the vulnerability by sending specially crafted UPnP SOAP requests to an affected device, enabling arbitrary operating system command execution. The attack requires no privileges, low complexity, or user interaction, making it highly accessible over the network.
Zyxel has issued a security advisory addressing this command injection vulnerability alongside null pointer dereference issues in certain 4G LTE, 5G NR CPE, DSL Ethernet CPE, fiber ONTs, security routers, and wireless extenders, available at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207551
Vulnerability details
A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote unauthenticated exploitation of a public-facing UPnP service (T1190) leading to arbitrary OS command execution on a likely Unix/Linux-based network device (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the command injection vulnerability by identifying, testing, and applying firmware patches as issued in the Zyxel security advisory.
Implements input validation mechanisms on UPnP SOAP requests to block specially crafted payloads that enable command injection.
Restricts or disables the nonessential UPnP function on the device to eliminate the attack surface for remote command injection.