An critical vulnerability in Universal PlugandPlay (UPnP) service of multiple small business VPN routers will not be patched because the devices have reached endoflife.
Unauthenticated attackers can exploit it to restart vulnerable devices or execute arbitrary code remotely as the root user on the underlying operating system.