{"id":"CVE-2025-13942","aliases":["EUVD-2025-207551","GHSA-934v-v4wh-rf2c"],"status":"published","title":"A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions...","description":"A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0117,"percentile":0.67853,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-02-24T02:32:18Z","modified":"2026-06-17T08:35:01Z","products":[{"vendor":"zyxel","product":"dx4510-b0_firmware"},{"vendor":"zyxel","product":"dx4510-b1_firmware"},{"vendor":"zyxel","product":"ee6510-10_firmware"},{"vendor":"zyxel","product":"emg6726-b10a_firmware"},{"vendor":"zyxel","product":"ex2210-t0_firmware"},{"vendor":"zyxel","product":"ex3510-b0 firmware"},{"vendor":"zyxel","product":"ex3510-b0_firmware"},{"vendor":"zyxel","product":"ex3510-b1_firmware"},{"vendor":"zyxel","product":"ex5510-b0_firmware"},{"vendor":"zyxel","product":"ex5512-t0_firmware"},{"vendor":"zyxel","product":"ex7710-b0_firmware"},{"vendor":"zyxel","product":"lte3301-plus_firmware"},{"vendor":"zyxel","product":"nebula_lte3301-plus_firmware"},{"vendor":"zyxel","product":"nebula_nr7101_firmware"},{"vendor":"zyxel","product":"nr7101_firmware"},{"vendor":"zyxel","product":"px3321-t1_firmware"},{"vendor":"zyxel","product":"px5301-t0_firmware"},{"vendor":"zyxel","product":"vmg4927-b50a_firmware"},{"vendor":"zyxel","product":"wx5610-b0_firmware"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13942"},{"url":"https://github.com/advisories/GHSA-934v-v4wh-rf2c"}],"sources":{"cve":[{"id":"CVE-2025-13942","description":"A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.","status":"published","published":"2026-02-24T02:32:18.934Z","modified":"2026-02-26T14:44:10.318Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:43.770144Z"}],"euvd":[{"id":"EUVD-2025-207551","description":"A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.","status":"published","published":"2026-02-24T02:32:18Z","modified":"2026-02-26T14:44:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:28.012266Z"}],"ghsa":[{"id":"GHSA-934v-v4wh-rf2c","title":"A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions...","description":"A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.","status":"published","published":"2026-02-24T03:30:20Z","modified":"2026-02-24T03:30:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:06:21.035092Z"}],"nvd":[{"id":"CVE-2025-13942","description":"A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.","status":"published","published":"2026-02-24T03:16:00.223Z","modified":"2026-06-17T08:35:01.26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:01.096037Z"}]}}