CVE-2025-13942
📋 TL;DR
A remote command injection vulnerability in Zyxel EX3510-B0 devices allows attackers to execute arbitrary operating system commands by sending specially crafted UPnP SOAP requests. This affects all firmware versions through 5.17(ABUP.15.1)C0, potentially compromising the entire device. Organizations using these Zyxel networking devices are at risk of complete system takeover.
💻 Affected Systems
- Zyxel EX3510-B0
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network pivoting to internal systems, data exfiltration, and device becoming part of botnet.
Likely Case
Remote attacker gains full control of affected device, can modify configurations, intercept traffic, and use device as foothold into internal network.
If Mitigated
If UPnP is disabled and network segmentation is in place, impact limited to device isolation and potential service disruption.
🎯 Exploit Status
Command injection via UPnP SOAP requests requires no authentication. Exploit development is straightforward given the CWE-78 pattern.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version after 5.17(ABUP.15.1)C0
Restart Required: Yes
Instructions:
1. Download latest firmware from Zyxel support portal. 2. Log into device web interface. 3. Navigate to Maintenance > Firmware Upgrade. 4. Upload firmware file. 5. Apply upgrade and wait for automatic reboot.
🔧 Temporary Workarounds
Disable UPnP Service
allDisable Universal Plug and Play service to prevent exploitation via SOAP requests
Web Interface: Advanced > UPnP > Disable
CLI: system upnp disable
Block UPnP Ports
linuxBlock access to UPnP ports (1900/udp, 5000/tcp) at firewall
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A INPUT -p tcp --dport 5000 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for unusual UPnP traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (Status > System Information) or CLI (show version). If version is 5.17(ABUP.15.1)C0 or earlier, device is vulnerable.Check Version:
show version (CLI) or check Status > System Information in web interfaceVerify Fix Applied:
Verify firmware version is newer than 5.17(ABUP.15.1)C0. Test UPnP functionality remains disabled if using workaround.📡 Detection & Monitoring
Log Indicators:
- Unusual UPnP SOAP requests in device logs
- Multiple failed UPnP requests from single source
- System command execution logs from non-admin processes
Network Indicators:
- Unusual traffic to UPnP ports (1900/udp, 5000/tcp)
- Outbound connections from device to unknown external IPs
- Sudden increase in device CPU/memory usage
SIEM Query:
source="zyxel_logs" AND ("UPnP" OR "SOAP") AND ("command" OR "exec" OR "system")