CVE-2025-13942: Critical RCE Vulnerability in Zyxel Routers Exposes Thousands to Remote Attacks

A single misconfigured setting can turn a household router into a launchpad for cyberattacks. The recent discovery of CVE-2025-13942—a critical remote command execution (RCE) flaw in Zyxel routers—has sent shockwaves through the cybersecurity community. This vulnerability, lurking in the Universal Plug and Play (UPnP) function, allows attackers to hijack devices with nothing more than a cleverly crafted network request. With over 120,000 Zyxel devices exposed online and more than 76,000 of those being routers, the scale of potential compromise is staggering. The flaw is especially concerning because it requires no authentication or user interaction, making it a prime target for automated attacks and botnet recruitment. As ISPs continue to deploy Zyxel hardware as default equipment, the risk of mass exploitation grows, underscoring the urgent need for awareness and action.

How CVE-2025-13942 Works: The Anatomy of a Router Vulnerability

Technical Breakdown of CVE-2025-13942

CVE-2025-13942 is a critical remote command execution (RCE) vulnerability identified in the Universal Plug and Play (UPnP) function of multiple Zyxel router models, including 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and wireless extenders. The flaw resides in the way these devices process UPnP SOAP (Simple Object Access Protocol) requests. Specifically, the vulnerability is a command injection issue, allowing unauthenticated attackers to execute arbitrary operating system commands on affected routers by sending specially crafted UPnP SOAP requests.

The vulnerability is triggered when the router’s UPnP service receives a maliciously formatted SOAP request containing embedded OS commands. Due to improper sanitization of user input within the UPnP handler, the device interprets and executes these commands with the privileges of the underlying operating system. This enables attackers to gain full control over the device, potentially leading to further exploitation or establishing persistent access.

This vulnerability is particularly dangerous because it does not require authentication or user interaction, making it exploitable by any remote attacker who can reach the device’s UPnP interface over the network, provided that both UPnP and WAN access are enabled.

Conditions Required for Exploitation

Although the vulnerability is rated as critical, successful exploitation is contingent on specific device configurations. By default, Zyxel routers ship with WAN access to UPnP disabled, reducing the immediate attack surface. However, if a user or administrator enables both UPnP and WAN access, the device becomes vulnerable to remote exploitation.

Attackers must first identify devices with both UPnP and WAN access enabled. This is typically accomplished through large-scale internet scanning, targeting known Zyxel device signatures and probing for open UPnP endpoints. Once a vulnerable device is found, the attacker sends a malicious SOAP request to the UPnP service, triggering the command injection flaw.

Attack Pathways and Exploitation Scenarios

The exploitation process for CVE-2025-13942 can be broken down into several key stages:

1. Discovery: Attackers use internet-wide scanning tools to locate Zyxel routers with exposed UPnP services.
2. Verification: The attacker sends benign UPnP requests to confirm the device model and firmware version, ensuring it is vulnerable.
3. Payload Delivery: A specially crafted UPnP SOAP request containing malicious OS commands is sent to the device.
4. Command Execution: The vulnerable UPnP handler processes the request, injecting and executing the attacker’s commands on the router’s operating system.
5. Post-Exploitation: The attacker may establish persistence, deploy malware, pivot to other devices on the network, or exfiltrate sensitive data.

This sequence is possible due to the lack of input validation in the UPnP SOAP handler, which fails to distinguish between legitimate and malicious requests. The attack does not require prior knowledge of user credentials or physical access to the device, making it a potent threat in scenarios where UPnP and WAN access are enabled.

Device Exposure and Internet-Scale Impact

The scale of exposure is significant. According to data from the Shadowserver Foundation, nearly 120,000 Zyxel devices are currently exposed to the internet, with over 76,000 of these being routers. The widespread use of Zyxel devices by internet service providers (ISPs) as default equipment for new internet service contracts increases the risk of mass exploitation.

The risk is further amplified by the fact that many users may be unaware of their device’s configuration, especially when default ISP settings are modified post-deployment. Attackers can leverage automated scripts to scan for and exploit vulnerable devices at scale, potentially leading to widespread compromise and the formation of large botnets or launching points for further attacks.

Security Implications and Mitigation Challenges

The critical nature of CVE-2025-13942 stems not only from its technical characteristics but also from the broader security implications for network infrastructure. Remote command execution vulnerabilities in routers are particularly dangerous because routers serve as the gateway between local networks and the internet. A compromised router can be used to:

• Intercept or redirect network traffic (man-in-the-middle attacks)
• Launch attacks on internal network devices
• Exfiltrate sensitive data
• Participate in distributed denial-of-service (DDoS) attacks

Mitigating this vulnerability poses several challenges:

• Patch Deployment: While Zyxel has released security updates, timely patch deployment is often hampered by end-user inaction, lack of awareness, or logistical constraints in ISP-managed environments.
• Legacy Devices: Zyxel has explicitly stated that several legacy models (e.g., VMG1312-B10A, VMG3312-B10A, SBG3300, SBG3500) have reached end-of-life (EOL) and will not receive patches. Users of these devices are strongly advised to replace them with newer, supported products.
• Configuration Complexity: Users may inadvertently enable UPnP and WAN access, increasing vulnerability exposure. ISPs and administrators must ensure secure default configurations and educate users about the risks of changing these settings.

The continued tracking of 12 actively exploited Zyxel vulnerabilities by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) underscores the persistent threat landscape facing network infrastructure. The presence of unpatched, internet-exposed routers remains a significant risk vector for both consumers and enterprises.

Final Thoughts

The CVE-2025-13942 vulnerability is a stark reminder that even everyday devices like routers can become high-value targets for cybercriminals. As attackers increasingly automate their search for exposed devices, the importance of secure default configurations, timely patching, and user education cannot be overstated. While Zyxel has moved quickly to release patches for supported models, the persistence of legacy, unpatched devices leaves a significant portion of the internet at risk. For both consumers and businesses, vigilance is key: regularly check device settings, apply updates, and stay informed about emerging threats. The evolving landscape of IoT and network infrastructure demands a proactive approach to security—because the next big breach could start with something as simple as an overlooked router setting.

References

• Zyxel warns of critical RCE flaw affecting over a dozen routers. (2026). BleepingComputer. https://www.bleepingcomputer.com/news/security/zyxel-warns-of-critical-rce-flaw-affecting-over-a-dozen-routers/