Loading story…
A critical vulnerability tracked as CVE-2025-54322 allows unauthenticated attackers to inject shell commands into an XSpeeder SXZOS management request and execute them with root privileges. Public reporting said the flaw is reachable over the network without authentication, creating a direct path to full device compromise through command injection in the management interface.
Technical analysis and a proof of concept were published by pwn.ai, with follow-on reporting highlighting broad internet exposure of affected systems. The public CVE record corroborates the existence of the unauthenticated root command-injection issue, raising concern that exposed SXZOS deployments could be targeted for remote takeover if the vulnerable management service is accessible.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A public CVE record exists for CVE-2025-54322, corroborating an unauthenticated root command injection vulnerability affecting XSpeeder SXZOS management requests.
On 2025-07-22, pwn.ai publicly reported technical analysis and a proof of concept for CVE-2025-54322, describing it as an unauthenticated network-reachable root RCE in XSpeeder SXZOS and noting broad internet exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical zero-day vulnerability, tracked as CVE-2025-54322 and rated CVSS 10, has been discovered in XSpeeder networking devices, exposing approximately 70,000 systems worldwide to remote compromise. The flaw, identified by the research firm pwn.ai using AI-driven analysis, allows attackers to gain root access to affected devices without authentication by exploiting the `chkid` parameter in the `vLogin.py` file. XSpeeder, a Chinese vendor specializing in edge devices such as routers, SD-WAN appliances, and smart TV controllers, has reportedly not responded to disclosure attempts for over seven months, leaving the vulnerability unpatched and devices at risk. The vulnerability enables attackers to execute arbitrary commands, potentially allowing them to monitor network traffic, steal sensitive data, or disrupt operations. Security researchers have highlighted the significance of this discovery as the first publicly disclosed agent-found, remotely exploitable 0-day, underscoring both the power of AI in vulnerability research and the risks posed by unresponsive vendors. Organizations using XSpeeder devices are urged to assess their exposure and implement network segmentation or other mitigations until a patch is made available, as the vendor has yet to address the issue despite repeated notifications.
Jun 29, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026
The Centre for Cybersecurity Belgium warned of a **critical OS command injection** vulnerability affecting **Zyxel EX3510-B0** routers’ UPnP functionality, tracked as **CVE-2025-13942** (CVSS 3.1 **9.8**, **CWE-78**). Successful exploitation could allow an unauthenticated remote attacker to execute OS commands by sending **specially crafted UPnP SOAP requests**, potentially leading to full device compromise. Zyxel published a security advisory covering this issue and recommended customers apply vendor updates; the Belgian advisory similarly urged **immediate patching** and increased monitoring, noting that updating does not remediate any **prior compromise**. Separately, Zyxel also disclosed a related but distinct command injection issue in a different model—**CVE-2025-13943** in **EX3301-T0**—which requires authentication and is triggered via the log file download function, and should be tracked and remediated as a separate vulnerability from the EX3510-B0 UPnP flaw.
Jun 29, 2026