Zyxel Issues Urgent Security Warning Over Critical Router Vulnerability

Taiwanese networking manufacturer Zyxel has issued a critical security advisory after uncovering a severe vulnerability affecting a wide range of its networking devices, including routers, fiber terminals, and wireless extenders. The flaw, which could allow attackers to remotely execute commands on vulnerable systems, has raised fresh concerns the security of widely deployed consumer and enterprise networking equipment.

At the centre of the advisory is a vulnerability tracked as CVE-2025-13942 , a command injection flaw located in the Universal Plug and Play (UPnP) feature of multiple Zyxel devices. According to the company, the issue affects more than a dozen models across product lines such as 4G/5G routers, DSL and Ethernet customer premises equipment (CPE), fibre ONTs, and Wi-Fi extenders.

Security researchers warn that the flaw allows unauthenticated attackers to send specially crafted UPnP SOAP requests to a device, potentially enabling remote command execution (RCE) at the operating system level. In practical terms, this could allow attackers to take control of affected devices, manipulate network traffic, or deploy further malware inside connected environments.

Despite its critical severity rating, Zyxel emphasised that exploitation of the flaw depends on specific configurations. For an attack to succeed, both WAN (Wide Area Network) access and the vulnerable UPnP functionality must be enabled on the device.

Importantly, WAN access is disabled by default on Zyxel routers, which may significantly reduce the number of devices immediately exposed to remote exploitation.

Nevertheless, the company urged users not to rely on default settings alone. “Users are strongly advised to install the patches to maintain optimal protection,” Zyxel said in its advisory, noting that configuration changes or mismanagement could still leave devices exposed.

Alongside the critical flaw, Zyxel also addressed two high-severity vulnerabilities — CVE-2025-13943 and CVE-2026-1459 — which affect authenticated users. These issues could allow attackers with compromised credentials to execute system-level commands, further highlighting the importance of strong password hygiene and access controls.

CVE-2025-13943: A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device. CVE-2026-1459: A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.7)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device.

Data from cybersecurity monitoring organisation Shadowserver Foundation indicates that nearly 120,000 Zyxel devices are currently exposed to the internet, including more than 76,000 routers. While not all exposed devices are necessarily vulnerable, the scale underscores the potential attack surface available to threat actors.

Zyxel hardware is particularly attractive to attackers because it is frequently distributed by internet service providers as default equipment in residential and small business broadband installations. This widespread deployment means that vulnerabilities can have global impact if exploited at scale.

The warning comes amid broader scrutiny of Zyxel’s security track record. The U.S. cybersecurity agency Cybersecurity and Infrastructure Security Agency (CISA) is currently tracking at least 12 vulnerabilities affecting Zyxel routers, firewalls, and NAS devices, some of which have already been exploited in real-world attacks.

Earlier in February, Zyxel faced criticism after confirming it would not patch two zero-day vulnerabilities affecting legacy, end-of-life routers. Those flaws — actively exploited in the wild — continue to pose a risk to users who have not upgraded their hardware.

The company instead advised customers to replace outdated models, including several devices from its VMG and SBG series, stating that these products have been unsupported for years and no longer receive security updates.

The situation highlights a persistent challenge in the networking industry: long device lifecycles combined with inconsistent patching practices.

While Zyxel has now released fixes for its latest vulnerabilities, users are being urged to:

Apply firmware updates immediately Disable unnecessary services like UPnP where possible Ensure remote access settings are secure Replace end-of-life hardware

As cyberattacks increasingly target edge devices such as routers, unpatched vulnerabilities can serve as entry points into and enterprise networks alike.

With tens of thousands of internet-facing devices and a history of active exploitation, the latest Zyxel advisory serves as a stark reminder that network infrastructure remains a high-value target in today’s threat landscape .