Loading story…
The Centre for Cybersecurity Belgium warned of a critical OS command injection vulnerability affecting Zyxel EX3510-B0 routers’ UPnP functionality, tracked as CVE-2025-13942 (CVSS 3.1 9.8, CWE-78). Successful exploitation could allow an unauthenticated remote attacker to execute OS commands by sending specially crafted UPnP SOAP requests, potentially leading to full device compromise.
Zyxel published a security advisory covering this issue and recommended customers apply vendor updates; the Belgian advisory similarly urged immediate patching and increased monitoring, noting that updating does not remediate any prior compromise. Separately, Zyxel also disclosed a related but distinct command injection issue in a different model—CVE-2025-13943 in EX3301-T0—which requires authentication and is triggered via the log file download function, and should be tracked and remediated as a separate vulnerability from the EX3510-B0 UPnP flaw.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting emphasized that nearly 120,000 Zyxel devices were internet-exposed and that exploitation of CVE-2025-13942 would require both UPnP and WAN access to be enabled. Coverage also noted CISA's tracking of multiple actively exploited Zyxel vulnerabilities and urged prompt patching or replacement of unsupported devices.
Belgium's Centre for Cybersecurity issued a public advisory warning of a critical vulnerability in various Zyxel routers and urged users to patch immediately. The alert amplified official remediation guidance following Zyxel's security release.
Zyxel released security updates for CVE-2025-13942, a critical unauthenticated command-injection vulnerability affecting multiple router, CPE, ONT, and extender models. The company also patched additional command-injection and denial-of-service issues, while noting some CVE-2026-1459 fixes for certain DSL/Ethernet CPE models were planned for March 2026.
Zyxel's security contact received the vulnerability report for CVE-2025-13942, a command injection flaw in the UPnP function of EX3510-B0 firmware. The issue could allow remote OS command execution via crafted UPnP SOAP requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourceccb.belgium.be
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026
Zyxel has disclosed and patched **CVE-2026-6952**, a post-authentication command injection flaw affecting certain **DSL/Ethernet CPE devices, Fiber ONTs, and Wireless Extenders** across multiple models and firmware versions. The vulnerability resides in the `LogServer` field of the syslog component and could let an authenticated attacker with administrator privileges execute operating system commands on an affected device. The Canadian Centre for Cyber Security issued alert **AV26-725** urging organizations, service providers, and users to review Zyxel’s advisory and apply the relevant firmware updates. Zyxel said WAN access is disabled by default and that exploitation requires valid or compromised user-configured credentials, and it published fixed firmware versions for affected products while crediting researcher **William Honnér** for reporting the issue.
Jul 21, 2026
Zyxel has disclosed multiple security vulnerabilities affecting several of its firewall product lines, including the ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series. One of the critical vulnerabilities, tracked as CVE-2025-9133, is a missing authorization flaw present in ATP series firmware versions from V4.32 through V5.40, USG FLEX series from V4.50 through V5.40, USG FLEX 50(W) from V4.16 through V5.40, and USG20(W)-VPN from V4.16 through V5.40. This vulnerability allows a semi-authenticated attacker—someone who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device. The ability to access configuration files could expose sensitive information, including network settings and potentially credentials, increasing the risk of further compromise. The vulnerability is remotely exploitable, making it a significant concern for organizations using these devices in perimeter security roles. In addition to the missing authorization issue, Zyxel's advisory also addresses a post-authentication command injection vulnerability in the same product lines, further elevating the risk profile. The Canadian Centre for Cyber Security has issued an alert urging users and administrators to review Zyxel's advisories and apply the necessary firmware updates to mitigate these risks. The vulnerabilities impact a wide range of firmware versions, indicating that many deployed devices may be at risk if not promptly updated. Zyxel has published detailed advisories and provided links for users to access patches and further information. The vulnerabilities were disclosed on October 21, 2025, and organizations are advised to act quickly to prevent potential exploitation. The missing authorization flaw specifically highlights the importance of robust authentication and session management in security appliances. Attackers exploiting this flaw could bypass intended access controls, undermining the security posture of affected networks. The command injection vulnerability, while requiring authentication, could allow attackers to execute arbitrary commands on the device, potentially leading to full system compromise. Both vulnerabilities underscore the need for regular firmware updates and vigilant monitoring of security advisories from vendors. Organizations should also review their 2FA implementations and ensure that partial authentication does not grant unintended access. The advisories recommend immediate patching as the primary mitigation step. Security teams are encouraged to audit their Zyxel device inventories and verify that all affected models are updated to the latest secure firmware versions. Failure to address these vulnerabilities could result in unauthorized access, data leakage, or further exploitation by threat actors. The coordinated disclosure and response from Zyxel and cybersecurity authorities aim to minimize the window of exposure for customers worldwide.
Jul 12, 2026