CVE-2026-1460
High
Description
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Zyxel Dx3301-t0 Firmware
PublishedApr 28, 2026
First seenApr 28, 2026
Weakness typeCWE-78OS command injection
How to fix
Update
- zyxel dx3301-t0_firmware5.50\(abvy.7.2\)c0 or later
- zyxel nebula_fwa70_firmware1.51\(acrf.0\)v0 or later
- zyxel nebula_fwa505_firmware1.60\(acko.3\)v0 or later
- zyxel nebula_fwa510_firmware1.60\(acgd.1\)v0 or later
- zyxel nebula_fwa515_firmware1.60\(acpz.1\)v0 or later
- zyxel nebula_fwa710_firmware1.60\(acgc.2\)v0 or later
- zyxel nebula_lte3301-plus_firmware1.18\(acca.7\)v0 or later
- zyxel nebula_lte7461-m602_firmware1.15\(acev.4\)v0 or later
- zyxel nebula_nr5101_firmware1.16\(accg.1\)v0 or later
- zyxel nebula_nr7101_firmware1.16\(accc.2\)v0 or later
- zyxel dx3300-t0_firmware5.50\(abvy.7.2\)c0 or later
- zyxel dx3300-t1_firmware5.50\(abvy.7.2\)c0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zyxel dx3301-t0_firmware | v < 5.50\(abvy.7.2\)c0 | 5.50\(abvy.7.2\)c0 |
| zyxel nebula_fwa70_firmware | v < 1.51\(acrf.0\)v0 | 1.51\(acrf.0\)v0 |
| zyxel nebula_fwa505_firmware | v < 1.60\(acko.3\)v0 | 1.60\(acko.3\)v0 |
| zyxel nebula_fwa510_firmware | v < 1.60\(acgd.1\)v0 | 1.60\(acgd.1\)v0 |
| zyxel nebula_fwa515_firmware | v < 1.60\(acpz.1\)v0 | 1.60\(acpz.1\)v0 |
| zyxel nebula_fwa710_firmware | v < 1.60\(acgc.2\)v0 | 1.60\(acgc.2\)v0 |
| zyxel nebula_lte3301-plus_firmware | v < 1.18\(acca.7\)v0 | 1.18\(acca.7\)v0 |
| zyxel nebula_lte7461-m602_firmware | v < 1.15\(acev.4\)v0 | 1.15\(acev.4\)v0 |
| zyxel nebula_nr5101_firmware | v < 1.16\(accg.1\)v0 | 1.16\(accg.1\)v0 |
| zyxel nebula_nr7101_firmware | v < 1.16\(accc.2\)v0 | 1.16\(accc.2\)v0 |
| zyxel dx3300-t0_firmware | v < 5.50\(abvy.7.2\)c0 | 5.50\(abvy.7.2\)c0 |
| zyxel dx3300-t1_firmware | v < 5.50\(abvy.7.2\)c0 | 5.50\(abvy.7.2\)c0 |
| zyxel dx5401-b1_firmware | v < 5.17\(abyo.7.2\)c0 | 5.17\(abyo.7.2\)c0 |
| zyxel ee3301-00_firmware | v < 5.63\(acmu.3.1\)c0 | 5.63\(acmu.3.1\)c0 |
| zyxel ee5301-00_firmware | v < 5.63\(acld.3.1\)c0 | 5.63\(acld.3.1\)c0 |
| zyxel ee6510-10_firmware | v < 5.19\(acjq.4.2\)c0 | 5.19\(acjq.4.2\)c0 |
| zyxel emg3525-t50b_firmware | v < 5.50\(abpm.9.8\)c0 | 5.50\(abpm.9.8\)c0 |
| zyxel emg5523-t50b_firmware | v < 5.50\(abpm.9.8\)c0 | 5.50\(abpm.9.8\)c0 |
| zyxel ex2210-t0_firmware | v < 5.50\(acdi.2.5\)c0 | 5.50\(acdi.2.5\)c0 |
| zyxel ex3300-t0_firmware | v < 5.50\(abvy.7.2\)c0 | 5.50\(abvy.7.2\)c0 |
| zyxel ex3300-t1_firmware | v < 5.50\(abvy.7.2\)c0 | 5.50\(abvy.7.2\)c0 |
| zyxel ex3301-t0_firmware | v < 5.50\(abvy.7.2\)c0 | 5.50\(abvy.7.2\)c0 |
| zyxel ex3500-t0_firmware | v < 5.44\(achr.6\)c0 | 5.44\(achr.6\)c0 |
| zyxel ex3501-t0_firmware | v < 5.44\(achr.6\)c0 | 5.44\(achr.6\)c0 |
| zyxel ex3600-t0_firmware | v < 5.70\(acif.3\)c0 | 5.70\(acif.3\)c0 |
| zyxel ex5401-b1_firmware | v < 5.17\(abyo.7.2\)c0 | 5.17\(abyo.7.2\)c0 |
| zyxel ex5512-t0_firmware | v < 5.70\(aceg.5.5\)c0 | 5.70\(aceg.5.5\)c0 |
| zyxel ex5601-t0_firmware | v < 5.70\(acdz.6\)c0 | 5.70\(acdz.6\)c0 |
| zyxel ex5601-t1_firmware | v < 5.70\(acdz.6\)c0 | 5.70\(acdz.6\)c0 |
| zyxel ex7501-b0_firmware | v < 5.18\(achn.3.2\)c0 | 5.18\(achn.3.2\)c0 |
| zyxel ex7710-b0_firmware | v < 5.18\(acak.1.7\)c0 | 5.18\(acak.1.7\)c0 |
| zyxel gm4100-b0_firmware | v < 5.18\(accl.2.1\)c0 | 5.18\(accl.2.1\)c0 |
| zyxel vmg3625-t50b_firmware | v < 5.50\(abpm.9.8\)c0 | 5.50\(abpm.9.8\)c0 |
| zyxel vmg4005-b50a_firmware | v < 5.17\(abqa.3.3\)c0 | 5.17\(abqa.3.3\)c0 |
| zyxel vmg4005-b60a_firmware | v < 5.17\(abqa.3.3\)c0 | 5.17\(abqa.3.3\)c0 |
| zyxel vmg8623-t50b_firmware | v < 5.50\(abpm.9.8\)c0 | 5.50\(abpm.9.8\)c0 |
| zyxel am7510-00_firmware | v < 5.63\(acor.0.2\)c0 | 5.63\(acor.0.2\)c0 |
| zyxel ax7501-b1_firmware | v < 5.17\(abpc.7.2\)c0 | 5.17\(abpc.7.2\)c0 |
| zyxel pe3301-00_firmware | v < 5.63\(acmt.3.1\)c0 | 5.63\(acmt.3.1\)c0 |
| zyxel pe5301-01_firmware | v < 5.63\(acoj.3.1\)c0 | 5.63\(acoj.3.1\)c0 |
| zyxel px5301-t0_firmware | v < 5.44\(ackb.0.7\)c0 | 5.44\(ackb.0.7\)c0 |
| zyxel px5302-00_firmware | v < 5.44\(acnm.0.1\)c0 | 5.44\(acnm.0.1\)c0 |
| zyxel we3300-00_firmware | v < 5.70\(acka.2\)c0 | 5.70\(acka.2\)c0 |
| zyxel we4600-00_firmware | v < 6.70\(ackt.1\)c0 | 6.70\(ackt.1\)c0 |
| zyxel wx5600-t0_firmware | v < 5.70\(aceb.6\)c0 | 5.70\(aceb.6\)c0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.