CVE-2026-1460
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.16% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- zyxel/nebula fwa70 firmware · zyxel/nebula fwa505 firmware · zyxel/nebula fwa510 firmware · zyxel/nebula fwa515 firmware · zyxel/nebula fwa710 firmware · zyxel/nebula lte3301-plus firmware · zyxel/nebula lte7461-m602 firmware · zyxel/nebula nr5101 firmware · zyxel/nebula nr7101 firmware · zyxel/dx3300-t0 firmware · zyxel/dx3300-t1 firmware · zyxel/dx3301-t0 firmware · zyxel/dx5401-b1 firmware · zyxel/ee3301-00 firmware · zyxel/ee5301-00 firmware · zyxel/ee6510-10 firmware · zyxel/emg3525-t50b firmware · zyxel/emg5523-t50b firmware · zyxel/ex2210-t0 firmware · zyxel/ex3300-t0 firmware · +25 more
- Source
- security@zyxel.com.tw
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.