{"id":"CVE-2026-0711","title":"A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS …","summary":"A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS …","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"zyxel","product":"nr5307_firmware","affected":["nr5307_firmware < 2.00\\(acjt.3\\)c0","nebula_fwa515_firmware < 1.60\\(acpz.0\\)v0","dx3300-t0_firmware < 5.50\\(abvy.7.2\\)c0","dx3300-t1_firmware < 5.50\\(abvy.7.2\\)c0","dx3301-t0_firmware < 5.50\\(abvy.7.2\\)c0","dx5401-b0_firmware < 5.17\\(abyo.7.2\\)c0","dx5401-b1_firmware < 5.17\\(abyo.7.2\\)c0","ee3301-00_firmware < 5.63\\(acmu.3.1\\)c0","ee5301-00_firmware < 5.63\\(acld.3.1\\)c0","ee6510-10_firmware < 5.19\\(acjq.4.2\\)c0","emg3525-t50b_firmware < 5.50\\(abpm.9.8\\)c0","emg5523-t50b_firmware < 5.50\\(abpm.9.8\\)c0","ex3300-t0_firmware < 5.50\\(abvy.7.2\\)c0","ex3300-t1_firmware < 5.50\\(abvy.7.2\\)c0","ex3301-t0_firmware < 5.50\\(abvy.7.2\\)c0","ex3500-t0_firmware < 5.44\\(achr.6\\)c0","ex3501-t0_firmware < 5.44\\(achr.6\\)c0","ex3600-t0_firmware < 5.70\\(acif.3\\)c0","ex5401-b0_firmware < 5.17\\(abyo.7.2\\)c0","ex5401-b1_firmware < 5.17\\(abyo.7.2\\)c0","ex5512-t0_firmware < 5.70\\(aceg.5.5\\)c0","ex5601-t0_firmware < 5.70\\(acdz.6\\)c0","ex5601-t1_firmware < 5.70\\(acdz.6\\)c0","ex7501-b0_firmware < 5.18\\(achn.3.2\\)c0","vmg3625-t50b_firmware < 5.50\\(abpm.9.8\\)c0","vmg8623-t50b_firmware < 5.50\\(abpm.9.8\\)c0","ax7501-b0_firmware < 5.17\\(abpc.7.2\\)c0","ax7501-b1_firmware < 5.17\\(abpc.7.2\\)c0","pe3301-00_firmware < 5.63\\(acmt.3.1\\)c0","pe5301-01_firmware < 5.63\\(acoj.3.1\\)c0","px5302-00_firmware < 5.44\\(acnm.0.1\\)c0","px5301-t0_firmware < 5.44\\(ackb.0.7\\)c0","we3300-00_firmware < 5.70\\(acka.2\\)c0","wx3100-t0_firmware < 5.50\\(abvl.4.10\\)c0","we4600-00_firmware < 6.70\\(ackt.1\\)c0","wx5600-t0_firmware < 5.70\\(aceb.6\\)c0"],"patched":["nr5307_firmware 2.00\\(acjt.3\\)c0","nebula_fwa515_firmware 1.60\\(acpz.0\\)v0","dx3300-t0_firmware 5.50\\(abvy.7.2\\)c0","dx3300-t1_firmware 5.50\\(abvy.7.2\\)c0","dx3301-t0_firmware 5.50\\(abvy.7.2\\)c0","dx5401-b0_firmware 5.17\\(abyo.7.2\\)c0","dx5401-b1_firmware 5.17\\(abyo.7.2\\)c0","ee3301-00_firmware 5.63\\(acmu.3.1\\)c0","ee5301-00_firmware 5.63\\(acld.3.1\\)c0","ee6510-10_firmware 5.19\\(acjq.4.2\\)c0","emg3525-t50b_firmware 5.50\\(abpm.9.8\\)c0","emg5523-t50b_firmware 5.50\\(abpm.9.8\\)c0","ex3300-t0_firmware 5.50\\(abvy.7.2\\)c0","ex3300-t1_firmware 5.50\\(abvy.7.2\\)c0","ex3301-t0_firmware 5.50\\(abvy.7.2\\)c0","ex3500-t0_firmware 5.44\\(achr.6\\)c0","ex3501-t0_firmware 5.44\\(achr.6\\)c0","ex3600-t0_firmware 5.70\\(acif.3\\)c0","ex5401-b0_firmware 5.17\\(abyo.7.2\\)c0","ex5401-b1_firmware 5.17\\(abyo.7.2\\)c0","ex5512-t0_firmware 5.70\\(aceg.5.5\\)c0","ex5601-t0_firmware 5.70\\(acdz.6\\)c0","ex5601-t1_firmware 5.70\\(acdz.6\\)c0","ex7501-b0_firmware 5.18\\(achn.3.2\\)c0","vmg3625-t50b_firmware 5.50\\(abpm.9.8\\)c0","vmg8623-t50b_firmware 5.50\\(abpm.9.8\\)c0","ax7501-b0_firmware 5.17\\(abpc.7.2\\)c0","ax7501-b1_firmware 5.17\\(abpc.7.2\\)c0","pe3301-00_firmware 5.63\\(acmt.3.1\\)c0","pe5301-01_firmware 5.63\\(acoj.3.1\\)c0","px5302-00_firmware 5.44\\(acnm.0.1\\)c0","px5301-t0_firmware 5.44\\(ackb.0.7\\)c0","we3300-00_firmware 5.70\\(acka.2\\)c0","wx3100-t0_firmware 5.50\\(abvl.4.10\\)c0","we4600-00_firmware 6.70\\(ackt.1\\)c0","wx5600-t0_firmware 5.70\\(aceb.6\\)c0"],"published":"2026-04-28","updated":"2026-07-08","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0711","references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026","label":"security@zyxel.com.tw"}],"tags":["nvd"],"epss":0.00849,"epssPercentile":0.56128,"ingestedAt":"2026-07-08T15:51:20.904Z","slug":"CVE-2026-0711","body":"## Overview\n\nA post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device.\n\n## Affected\n\n- `nr5307_firmware < 2.00\\(acjt.3\\)c0`\n- `nebula_fwa515_firmware < 1.60\\(acpz.0\\)v0`\n- `dx3300-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `dx3300-t1_firmware < 5.50\\(abvy.7.2\\)c0`\n- `dx3301-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `dx5401-b0_firmware < 5.17\\(abyo.7.2\\)c0`\n- `dx5401-b1_firmware < 5.17\\(abyo.7.2\\)c0`\n- `ee3301-00_firmware < 5.63\\(acmu.3.1\\)c0`\n- `ee5301-00_firmware < 5.63\\(acld.3.1\\)c0`\n- `ee6510-10_firmware < 5.19\\(acjq.4.2\\)c0`\n- `emg3525-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `emg5523-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `ex3300-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `ex3300-t1_firmware < 5.50\\(abvy.7.2\\)c0`\n- `ex3301-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `ex3500-t0_firmware < 5.44\\(achr.6\\)c0`\n- `ex3501-t0_firmware < 5.44\\(achr.6\\)c0`\n- `ex3600-t0_firmware < 5.70\\(acif.3\\)c0`\n- `ex5401-b0_firmware < 5.17\\(abyo.7.2\\)c0`\n- `ex5401-b1_firmware < 5.17\\(abyo.7.2\\)c0`\n- `ex5512-t0_firmware < 5.70\\(aceg.5.5\\)c0`\n- `ex5601-t0_firmware < 5.70\\(acdz.6\\)c0`\n- `ex5601-t1_firmware < 5.70\\(acdz.6\\)c0`\n- `ex7501-b0_firmware < 5.18\\(achn.3.2\\)c0`\n- `vmg3625-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `vmg8623-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `ax7501-b0_firmware < 5.17\\(abpc.7.2\\)c0`\n- `ax7501-b1_firmware < 5.17\\(abpc.7.2\\)c0`\n- `pe3301-00_firmware < 5.63\\(acmt.3.1\\)c0`\n- `pe5301-01_firmware < 5.63\\(acoj.3.1\\)c0`\n- `px5302-00_firmware < 5.44\\(acnm.0.1\\)c0`\n- `px5301-t0_firmware < 5.44\\(ackb.0.7\\)c0`\n- `we3300-00_firmware < 5.70\\(acka.2\\)c0`\n- `wx3100-t0_firmware < 5.50\\(abvl.4.10\\)c0`\n- `we4600-00_firmware < 6.70\\(ackt.1\\)c0`\n- `wx5600-t0_firmware < 5.70\\(aceb.6\\)c0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `nr5307_firmware 2.00\\(acjt.3\\)c0`\n- `nebula_fwa515_firmware 1.60\\(acpz.0\\)v0`\n- `dx3300-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `dx3300-t1_firmware 5.50\\(abvy.7.2\\)c0`\n- `dx3301-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `dx5401-b0_firmware 5.17\\(abyo.7.2\\)c0`\n- `dx5401-b1_firmware 5.17\\(abyo.7.2\\)c0`\n- `ee3301-00_firmware 5.63\\(acmu.3.1\\)c0`\n- `ee5301-00_firmware 5.63\\(acld.3.1\\)c0`\n- `ee6510-10_firmware 5.19\\(acjq.4.2\\)c0`\n- `emg3525-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `emg5523-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `ex3300-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `ex3300-t1_firmware 5.50\\(abvy.7.2\\)c0`\n- `ex3301-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `ex3500-t0_firmware 5.44\\(achr.6\\)c0`\n- `ex3501-t0_firmware 5.44\\(achr.6\\)c0`\n- `ex3600-t0_firmware 5.70\\(acif.3\\)c0`\n- `ex5401-b0_firmware 5.17\\(abyo.7.2\\)c0`\n- `ex5401-b1_firmware 5.17\\(abyo.7.2\\)c0`\n- `ex5512-t0_firmware 5.70\\(aceg.5.5\\)c0`\n- `ex5601-t0_firmware 5.70\\(acdz.6\\)c0`\n- `ex5601-t1_firmware 5.70\\(acdz.6\\)c0`\n- `ex7501-b0_firmware 5.18\\(achn.3.2\\)c0`\n- `vmg3625-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `vmg8623-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `ax7501-b0_firmware 5.17\\(abpc.7.2\\)c0`\n- `ax7501-b1_firmware 5.17\\(abpc.7.2\\)c0`\n- `pe3301-00_firmware 5.63\\(acmt.3.1\\)c0`\n- `pe5301-01_firmware 5.63\\(acoj.3.1\\)c0`\n- `px5302-00_firmware 5.44\\(acnm.0.1\\)c0`\n- `px5301-t0_firmware 5.44\\(ackb.0.7\\)c0`\n- `we3300-00_firmware 5.70\\(acka.2\\)c0`\n- `wx3100-t0_firmware 5.50\\(abvl.4.10\\)c0`\n- `we4600-00_firmware 6.70\\(ackt.1\\)c0`\n- `wx5600-t0_firmware 5.70\\(aceb.6\\)c0`","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}