Critical · 9.8 CVE-2025-13942 EUVD-2025-207551GHSA-934v-v4wh-rf2c

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a rem…

Published Feb 24, 2026 · Updated Feb 26, 2026 · Assigned by Zyxel

Vendor: Zyxel Product: EX3510-B0 firmware Category: Network devices

Description

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	EX3510-B0 firmware	<= 5.17(ABUP.15.1)C0	—

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026 vendor-advisory