Back Securityaffairs.Co

Critical Zyxel router flaw exposed devices to remote attacks

Securityaffairs.Co •Pierluigi Paganini • February 25, 2026

Zyxel fixed a critical flaw in multiple routers that lets unauthenticated attackers remotely execute commands on vulnerable devices. Zyxel addressed a critical remote code execution vulnerability, tracked as CVE-2025-13942 (CVSS score of 9.8), affecting more than a dozen router models. A command injection flaw in the UPnP feature of several Zyxel CPEs, Fiber ONTs, and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zyxel Addresses Critical RCE Flaw in Multiple Router Models Zyxel has issued security updates for a critical remote command execution vulnerability, tracked as CVE-2025-13942, affecting various router models. The flaw exists in the UPnP function, allowing unauthenticated attackers to execute arbitrary OS commands on unpatched devices. Affected devices include Zyxel's 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and wireless extenders. 11 sources 68

Extracted Entities

Critical Zyxel router flaw exposed devices to remote attacks

The full story

Extracted Entities

Companies (1)

CVEs (1)

MITRE ATT&CK (1)