CVE-2025-13942

Classification basis

The rce.py script actively exploits the vulnerability by sending crafted SOAP requests to inject OS commands and establish a reverse shell. It does not merely detect or report the vulnerability; it executes the full exploitation chain.

Requirements

• Target device must be running a vulnerable version of the Zyxel zupnp service with the UPnP control interface exposed on TCP port 38400.README.md:3
• Attacker must be able to reach TCP port 38400 on the target device.rce.py:12
• Attacker must provide a listener IP and port for the reverse shell connection.rce.py:3-4

Observed behavior

• Sends a DeletePortMapping SOAP request to clear an existing port mapping entry.rce.py:15-31
• Sends an AddPortMapping SOAP request with a command injection payload in the NewInternalClient field to delete a temporary file on the target.rce.py:68
• Iterates through each character of a reverse shell command and sends an AddPortMapping request per character to append it to a temporary script file on the target using printf.rce.py:75-88
• Sends a final AddPortMapping request to execute the assembled reverse shell script on the target.rce.py:93
• Starts a local netcat listener to receive the reverse shell connection.rce.py:61-63

Observables

Reverse Shell

Payload withheldThe script constructs and executes a reverse shell on the target device, which is the stated goal of the exploit.rce.py:8

Listener

Payload withheldThe script starts a netcat listener on the attacker's machine to receive the reverse shell connection.rce.py:9rce.py:62-63