CVE-2025-13942 is a critical (9.8) command injection in the UPnP function of Zyxel EX3510-B0 and many related models. Crafted UPnP SOAP requests can run operating system commands. Zyxel has fixed firmware for the listed models, so contact Zyxel or your ISP for it and keep WAN access and UPnP disabled.
What's affected
Zyxel's February 2026 advisory lists affected firmware and fixed firmware per model. Examples from its table:
- EX3510-B0 and B1: affected 5.17(ABUP.15.1)C0 and earlier, fixed 5.17(ABUP.15.2)C0
- DX4510-B0 and B1: affected 5.17(ABYL.10)C0 and earlier, fixed 5.17(ABYL.10.1)C0
- EE6510-10: fixed 5.19(ACJQ.4.1)C0
- EMG6726-B10A: fixed 5.13(ABNP.8.2)C1
- EX2210-T0: fixed 5.50(ACDI.2.4)C0
- EX5510-B0: fixed 5.17(ABQX.11.1)C0
- EX5512-T0: fixed 5.70(ACEG.5.4)C0
- EX7710-B0: fixed 5.18(ACAK.1.6)C0
- VMG4927-B50A: fixed 5.13(ABLY.10.2)C0
- LTE3301-PLUS, NR7101, Nebula variants, PX3321-T1, PX5301-T0 and WX5610-B0 are also listed with their own fixed builds.
The advisory excludes custom ISP models. Devices supplied by an ISP may need the update to come through the ISP.
The advisory says the attack is remote only if both WAN access and UPnP are enabled, and that WAN access is disabled by default.
How to check if you're exposed
Check the model and firmware.
- Sign in to the device web interface and read the model and firmware version on the status page.
- Compare it with the table in the Zyxel advisory.
- Check the UPnP setting and whether remote management from the WAN is enabled.
- If an ISP manages the device, ask the ISP which firmware it has deployed.
What to do now
- Identify every affected Zyxel device and its firmware version.
- Request the fixed firmware from Zyxel support or your sales contact, or from your ISP for ISP supplied devices. Zyxel says to contact them for the files.
- Turn off WAN access to the management interface.
- Turn off UPnP unless you have a specific need for it.
- Reboot after the update and verify the new version number.
Why it matters
The weakness is CWE-78, OS command injection. The UPnP service reads fields from a SOAP request and uses them in a way that lets extra commands run on the device. The advisory describes this at the level of the feature and the request type.
UPnP exists to let devices on the local network configure the router automatically. Anything that expands what the network edge accepts needs careful handling, and many past router bugs sit in UPnP code. Turning off features you do not use is a reliable way to shrink the attack surface of home and branch routers.
Quick check
Is the device exposed by default?
Zyxel says the attack is remote only when both WAN access and UPnP are enabled, and WAN access is disabled by default.
Sources
Last reviewed: 19 October 2026.
