Zyxel Routers Patched Against Critical Remote Command Injection Flaws
2 min. read 
Published on
Zyxel released urgent firmware updates for 4G LTE/5G NR CPEs, DSL routers, Fiber ONTs, security routers, and wireless extenders. Seven vulnerabilities include unauthenticated command injection and DoS crashes. CVE-2025-13942 tops the list at CVSS 9.8. Attackers could fully compromise devices through crafted UPnP requests.
WAN access stays disabled by default on all models. This blocks remote exploits unless users manually enable it. Post-auth flaws need admin login first. Still enterprises and homes run exposed firmware. Update immediately to close gaps.
Researchers Tiantai Zhang, Víctor Fresco, and Watchful IP found the issues. Zyxel pushed patches fast for most devices. DSL models like DX5401-B1 await March fixes for CVE-2026-1459.
Vulnerability Breakdown
Flaws span command injection and crashes. Unauthenticated hits hardest.
| CVE ID | Type | Impact | Requirements |
|---|---|---|---|
| CVE-2025-13942 | UPnP Command Injection | Full RCE (CVSS 9.8) | WAN+UPnP enabled |
| CVE-2025-13943 | Post-auth Cmd Injection | OS command exec | Admin login |
| CVE-2026-1459 | Post-auth Cmd Injection | OS command exec | Admin + TR-369 CGI |
| CVE-2025-11845 | Null Pointer DoS | Device crash | HTTP to cert CGI |
| CVE-2025-11846 | Null Pointer DoS | Device crash | Account settings CGI |
| CVE-2025-11847 | Null Pointer DoS | Device crash | IP settings CGI |
| CVE-2025-11848 | Null Pointer DoS | Device crash | Wake-on-LAN CGI |
Affected Devices
Critical RCE hits these models:
| Category | Model | Vulnerable FW | Patch FW |
|---|---|---|---|
| 4G LTE/5G CPE | Nebula NR7101 | 1.16(ACCC.1)C0 | 1.16(ACCC.1)V0 |
| DSL/Ethernet CPE | DX4510-B0 | 5.17(ABYL.10)C0 | 5.17(ABYL.10.1)C0 |
| Fiber ONT | PX5301-T0 | 5.44(ACKB.0.5)C0 | 5.44(ACKB.0.6)C0 |
| Wireless Extender | WX5610-B0 | 5.18(ACGJ.0.4)C0 | 5.18(ACGJ.0.5)C0 |
Attack Scenarios
Remote RCE needs WAN and UPnP both active. Crafted SOAP requests execute OS commands. Post-auth flaws run through log downloads and TR-369 cert CGI.
DoS hits crash devices via malformed HTTP. Five null pointer flaws trigger separately. Admin creds unlock worst cases.
ISP gear needs provider patches. Consumer routers expose homes to botnets.
Patch Process
Update your Zyxel device:
- Download firmware from Zyxel support portal
- Login to web interface as admin
- Upload firmware via upgrade page
- Reboot after verification
- Disable WAN access and UPnP when possible
Change default passwords now. Test connectivity post-patch.
FAQ
CVE-2025-13942 unauthenticated UPnP RCE (CVSS 9.8).
Yes if WAN access and UPnP enabled manually.
NR7101, DX4510-B0, PX5301-T0, WX5610-B0 and more.
Yes. Contact provider for firmware.
Official support portal security advisories.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages