Critical Zyxel router flaw exposed devices to remote attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11846 +1 in the same advisory: …11845 | A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request. NVD description · AI analysis pending | 4.9 | 1% |
| — | ||
| CVE-2025-11847 | A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX310 A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request. NVD description · AI analysis pending | 4.9 | 2% |
| — | ||
| CVE-2025-13943 +1 in the same advisory: …11848 | A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could al A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device. NVD description · AI analysis pending | 8.8 group max | 1% |
| — | ||
| CVE-2025-13942 | A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execu A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests. NVD description · AI analysis pending | 9.8 | 1% |
| — | ||
| CVE-2026-1459 | A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(AB A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device. NVD description · AI analysis pending | 7.2 | <1% |
| — |
Full article353 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 25, 2026
Zyxel fixed a critical flaw in multiple routers that lets unauthenticated attackers remotely execute commands on vulnerable devices.
Zyxel addressed a critical remote code execution vulnerability, tracked as CVE-2025-13942 (CVSS score of 9.8), affecting more than a dozen router models.
A command injection flaw in the UPnP feature of several Zyxel CPEs, Fiber ONTs, and wireless extenders lets attackers run OS commands via crafted UPnP requests. Remote exploitation requires both WAN access and the vulnerable UPnP function to be enabled, as WAN access is disabled by default.
“A command injection vulnerability in the UPnP function of certain 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders firmware versions could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.” reads the advisory published by the vendor. “It is important to note that WAN access is disabled by default on these devices, and the attack can be carried out remotely only if both WAN access and the vulnerable UPnP function have been enabled.”
CVE-2026-1459 affects several Zyxel DSL/Ethernet CPE router models, including DX5401-B1, EMG3525-T50B, EMG5523-T50B, VMG3625-T50B/C, and VMG8623-T50B running specified firmware versions and earlier. Zyxel plans to release patched firmware versions for all impacted models in March 2026.
The Taiwanese manufacturer also addressed other vulnerabilities affecting multiple Zyxel CPEs, Fiber ONTs, security routers, and wireless extenders. CVE-2025-11847 and CVE-2025-11848 are null pointer dereference flaws in IP settings and Wake-on-LAN CGI components that allow authenticated administrators to trigger a denial-of-service via crafted HTTP requests. CVE-2025-13943 and CVE-2026-1459 are post-authentication command injection bugs in log download and TR-369 certificate functions, enabling OS command execution. In all cases, WAN access remains disabled by default, and successful exploitation requires compromised administrator credentials.
The researcher Tiantai Zhang from Purdue University disclosed the vulnerabilities CVE-2025-11845, CVE-2025-11846, CVE-2025-11847, and CVE-2025-11848.
Víctor Fresco (@hacefresko) reported the flaws CVE-2025-13942 and CVE-2025-13943, while Watchful IP disclosed the flaw CVE-2026-1459.
Users are urged to update affected routers immediately to prevent exploitation.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Zyxel)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/188501/security/critical-zyxel-router-flaw-exposed-devices-to-remote-attacks.html