CVE-2025-13942

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions...

9.8 Critical

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.17%Up 0.8 points since Feb 24, 2026

What each source reports

CVE List Score used 9.8

Record: CVE-2025-13942
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2025-207551 9.8

Record: EUVD-2025-207551
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-934v-v4wh-rf2c 9.8

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions...

Record: GHSA-934v-v4wh-rf2c
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

NVD 9.8

Record: CVE-2025-13942
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

Show 6 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-13942 is a critical vulnerability (CVSS 9.8) in Zyxel Ex3510-b0 Firmware, published February 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. No source names a fixed version.