{"id":"CVE-2026-1460","title":"A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with adm…","summary":"A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with adm…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"zyxel","product":"nebula_fwa70_firmware","affected":["nebula_fwa70_firmware < 1.51\\(acrf.0\\)v0","nebula_fwa505_firmware < 1.60\\(acko.3\\)v0","nebula_fwa510_firmware < 1.60\\(acgd.1\\)v0","nebula_fwa515_firmware < 1.60\\(acpz.1\\)v0","nebula_fwa710_firmware < 1.60\\(acgc.2\\)v0","nebula_lte3301-plus_firmware < 1.18\\(acca.7\\)v0","nebula_lte7461-m602_firmware < 1.15\\(acev.4\\)v0","nebula_nr5101_firmware < 1.16\\(accg.1\\)v0","nebula_nr7101_firmware < 1.16\\(accc.2\\)v0","dx3300-t0_firmware < 5.50\\(abvy.7.2\\)c0","dx3300-t1_firmware < 5.50\\(abvy.7.2\\)c0","dx3301-t0_firmware < 5.50\\(abvy.7.2\\)c0","dx5401-b1_firmware < 5.17\\(abyo.7.2\\)c0","ee3301-00_firmware < 5.63\\(acmu.3.1\\)c0","ee5301-00_firmware < 5.63\\(acld.3.1\\)c0","ee6510-10_firmware < 5.19\\(acjq.4.2\\)c0","emg3525-t50b_firmware < 5.50\\(abpm.9.8\\)c0","emg5523-t50b_firmware < 5.50\\(abpm.9.8\\)c0","ex2210-t0_firmware < 5.50\\(acdi.2.5\\)c0","ex3300-t0_firmware < 5.50\\(abvy.7.2\\)c0","ex3300-t1_firmware < 5.50\\(abvy.7.2\\)c0","ex3301-t0_firmware < 5.50\\(abvy.7.2\\)c0","ex3500-t0_firmware < 5.44\\(achr.6\\)c0","ex3501-t0_firmware < 5.44\\(achr.6\\)c0","ex3600-t0_firmware < 5.70\\(acif.3\\)c0","ex5401-b1_firmware < 5.17\\(abyo.7.2\\)c0","ex5512-t0_firmware < 5.70\\(aceg.5.5\\)c0","ex5601-t0_firmware < 5.70\\(acdz.6\\)c0","ex5601-t1_firmware < 5.70\\(acdz.6\\)c0","ex7501-b0_firmware < 5.18\\(achn.3.2\\)c0","ex7710-b0_firmware < 5.18\\(acak.1.7\\)c0","gm4100-b0_firmware < 5.18\\(accl.2.1\\)c0","vmg3625-t50b_firmware < 5.50\\(abpm.9.8\\)c0","vmg4005-b50a_firmware < 5.17\\(abqa.3.3\\)c0","vmg4005-b60a_firmware < 5.17\\(abqa.3.3\\)c0","vmg8623-t50b_firmware < 5.50\\(abpm.9.8\\)c0","am7510-00_firmware < 5.63\\(acor.0.2\\)c0","ax7501-b1_firmware < 5.17\\(abpc.7.2\\)c0","pe3301-00_firmware < 5.63\\(acmt.3.1\\)c0","pe5301-01_firmware < 5.63\\(acoj.3.1\\)c0","px5301-t0_firmware < 5.44\\(ackb.0.7\\)c0","px5302-00_firmware < 5.44\\(acnm.0.1\\)c0","we3300-00_firmware < 5.70\\(acka.2\\)c0","we4600-00_firmware < 6.70\\(ackt.1\\)c0","wx5600-t0_firmware < 5.70\\(aceb.6\\)c0"],"patched":["nebula_fwa70_firmware 1.51\\(acrf.0\\)v0","nebula_fwa505_firmware 1.60\\(acko.3\\)v0","nebula_fwa510_firmware 1.60\\(acgd.1\\)v0","nebula_fwa515_firmware 1.60\\(acpz.1\\)v0","nebula_fwa710_firmware 1.60\\(acgc.2\\)v0","nebula_lte3301-plus_firmware 1.18\\(acca.7\\)v0","nebula_lte7461-m602_firmware 1.15\\(acev.4\\)v0","nebula_nr5101_firmware 1.16\\(accg.1\\)v0","nebula_nr7101_firmware 1.16\\(accc.2\\)v0","dx3300-t0_firmware 5.50\\(abvy.7.2\\)c0","dx3300-t1_firmware 5.50\\(abvy.7.2\\)c0","dx3301-t0_firmware 5.50\\(abvy.7.2\\)c0","dx5401-b1_firmware 5.17\\(abyo.7.2\\)c0","ee3301-00_firmware 5.63\\(acmu.3.1\\)c0","ee5301-00_firmware 5.63\\(acld.3.1\\)c0","ee6510-10_firmware 5.19\\(acjq.4.2\\)c0","emg3525-t50b_firmware 5.50\\(abpm.9.8\\)c0","emg5523-t50b_firmware 5.50\\(abpm.9.8\\)c0","ex2210-t0_firmware 5.50\\(acdi.2.5\\)c0","ex3300-t0_firmware 5.50\\(abvy.7.2\\)c0","ex3300-t1_firmware 5.50\\(abvy.7.2\\)c0","ex3301-t0_firmware 5.50\\(abvy.7.2\\)c0","ex3500-t0_firmware 5.44\\(achr.6\\)c0","ex3501-t0_firmware 5.44\\(achr.6\\)c0","ex3600-t0_firmware 5.70\\(acif.3\\)c0","ex5401-b1_firmware 5.17\\(abyo.7.2\\)c0","ex5512-t0_firmware 5.70\\(aceg.5.5\\)c0","ex5601-t0_firmware 5.70\\(acdz.6\\)c0","ex5601-t1_firmware 5.70\\(acdz.6\\)c0","ex7501-b0_firmware 5.18\\(achn.3.2\\)c0","ex7710-b0_firmware 5.18\\(acak.1.7\\)c0","gm4100-b0_firmware 5.18\\(accl.2.1\\)c0","vmg3625-t50b_firmware 5.50\\(abpm.9.8\\)c0","vmg4005-b50a_firmware 5.17\\(abqa.3.3\\)c0","vmg4005-b60a_firmware 5.17\\(abqa.3.3\\)c0","vmg8623-t50b_firmware 5.50\\(abpm.9.8\\)c0","am7510-00_firmware 5.63\\(acor.0.2\\)c0","ax7501-b1_firmware 5.17\\(abpc.7.2\\)c0","pe3301-00_firmware 5.63\\(acmt.3.1\\)c0","pe5301-01_firmware 5.63\\(acoj.3.1\\)c0","px5301-t0_firmware 5.44\\(ackb.0.7\\)c0","px5302-00_firmware 5.44\\(acnm.0.1\\)c0","we3300-00_firmware 5.70\\(acka.2\\)c0","we4600-00_firmware 6.70\\(ackt.1\\)c0","wx5600-t0_firmware 5.70\\(aceb.6\\)c0"],"published":"2026-04-28","updated":"2026-07-08","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-1460","references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026","label":"security@zyxel.com.tw"}],"tags":["nvd"],"epss":0.01157,"epssPercentile":0.65206,"ingestedAt":"2026-07-08T15:51:20.910Z","slug":"CVE-2026-1460","body":"## Overview\n\nA post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.\n\n## Affected\n\n- `nebula_fwa70_firmware < 1.51\\(acrf.0\\)v0`\n- `nebula_fwa505_firmware < 1.60\\(acko.3\\)v0`\n- `nebula_fwa510_firmware < 1.60\\(acgd.1\\)v0`\n- `nebula_fwa515_firmware < 1.60\\(acpz.1\\)v0`\n- `nebula_fwa710_firmware < 1.60\\(acgc.2\\)v0`\n- `nebula_lte3301-plus_firmware < 1.18\\(acca.7\\)v0`\n- `nebula_lte7461-m602_firmware < 1.15\\(acev.4\\)v0`\n- `nebula_nr5101_firmware < 1.16\\(accg.1\\)v0`\n- `nebula_nr7101_firmware < 1.16\\(accc.2\\)v0`\n- `dx3300-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `dx3300-t1_firmware < 5.50\\(abvy.7.2\\)c0`\n- `dx3301-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `dx5401-b1_firmware < 5.17\\(abyo.7.2\\)c0`\n- `ee3301-00_firmware < 5.63\\(acmu.3.1\\)c0`\n- `ee5301-00_firmware < 5.63\\(acld.3.1\\)c0`\n- `ee6510-10_firmware < 5.19\\(acjq.4.2\\)c0`\n- `emg3525-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `emg5523-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `ex2210-t0_firmware < 5.50\\(acdi.2.5\\)c0`\n- `ex3300-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `ex3300-t1_firmware < 5.50\\(abvy.7.2\\)c0`\n- `ex3301-t0_firmware < 5.50\\(abvy.7.2\\)c0`\n- `ex3500-t0_firmware < 5.44\\(achr.6\\)c0`\n- `ex3501-t0_firmware < 5.44\\(achr.6\\)c0`\n- `ex3600-t0_firmware < 5.70\\(acif.3\\)c0`\n- `ex5401-b1_firmware < 5.17\\(abyo.7.2\\)c0`\n- `ex5512-t0_firmware < 5.70\\(aceg.5.5\\)c0`\n- `ex5601-t0_firmware < 5.70\\(acdz.6\\)c0`\n- `ex5601-t1_firmware < 5.70\\(acdz.6\\)c0`\n- `ex7501-b0_firmware < 5.18\\(achn.3.2\\)c0`\n- `ex7710-b0_firmware < 5.18\\(acak.1.7\\)c0`\n- `gm4100-b0_firmware < 5.18\\(accl.2.1\\)c0`\n- `vmg3625-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `vmg4005-b50a_firmware < 5.17\\(abqa.3.3\\)c0`\n- `vmg4005-b60a_firmware < 5.17\\(abqa.3.3\\)c0`\n- `vmg8623-t50b_firmware < 5.50\\(abpm.9.8\\)c0`\n- `am7510-00_firmware < 5.63\\(acor.0.2\\)c0`\n- `ax7501-b1_firmware < 5.17\\(abpc.7.2\\)c0`\n- `pe3301-00_firmware < 5.63\\(acmt.3.1\\)c0`\n- `pe5301-01_firmware < 5.63\\(acoj.3.1\\)c0`\n- `px5301-t0_firmware < 5.44\\(ackb.0.7\\)c0`\n- `px5302-00_firmware < 5.44\\(acnm.0.1\\)c0`\n- `we3300-00_firmware < 5.70\\(acka.2\\)c0`\n- `we4600-00_firmware < 6.70\\(ackt.1\\)c0`\n- `wx5600-t0_firmware < 5.70\\(aceb.6\\)c0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `nebula_fwa70_firmware 1.51\\(acrf.0\\)v0`\n- `nebula_fwa505_firmware 1.60\\(acko.3\\)v0`\n- `nebula_fwa510_firmware 1.60\\(acgd.1\\)v0`\n- `nebula_fwa515_firmware 1.60\\(acpz.1\\)v0`\n- `nebula_fwa710_firmware 1.60\\(acgc.2\\)v0`\n- `nebula_lte3301-plus_firmware 1.18\\(acca.7\\)v0`\n- `nebula_lte7461-m602_firmware 1.15\\(acev.4\\)v0`\n- `nebula_nr5101_firmware 1.16\\(accg.1\\)v0`\n- `nebula_nr7101_firmware 1.16\\(accc.2\\)v0`\n- `dx3300-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `dx3300-t1_firmware 5.50\\(abvy.7.2\\)c0`\n- `dx3301-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `dx5401-b1_firmware 5.17\\(abyo.7.2\\)c0`\n- `ee3301-00_firmware 5.63\\(acmu.3.1\\)c0`\n- `ee5301-00_firmware 5.63\\(acld.3.1\\)c0`\n- `ee6510-10_firmware 5.19\\(acjq.4.2\\)c0`\n- `emg3525-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `emg5523-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `ex2210-t0_firmware 5.50\\(acdi.2.5\\)c0`\n- `ex3300-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `ex3300-t1_firmware 5.50\\(abvy.7.2\\)c0`\n- `ex3301-t0_firmware 5.50\\(abvy.7.2\\)c0`\n- `ex3500-t0_firmware 5.44\\(achr.6\\)c0`\n- `ex3501-t0_firmware 5.44\\(achr.6\\)c0`\n- `ex3600-t0_firmware 5.70\\(acif.3\\)c0`\n- `ex5401-b1_firmware 5.17\\(abyo.7.2\\)c0`\n- `ex5512-t0_firmware 5.70\\(aceg.5.5\\)c0`\n- `ex5601-t0_firmware 5.70\\(acdz.6\\)c0`\n- `ex5601-t1_firmware 5.70\\(acdz.6\\)c0`\n- `ex7501-b0_firmware 5.18\\(achn.3.2\\)c0`\n- `ex7710-b0_firmware 5.18\\(acak.1.7\\)c0`\n- `gm4100-b0_firmware 5.18\\(accl.2.1\\)c0`\n- `vmg3625-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `vmg4005-b50a_firmware 5.17\\(abqa.3.3\\)c0`\n- `vmg4005-b60a_firmware 5.17\\(abqa.3.3\\)c0`\n- `vmg8623-t50b_firmware 5.50\\(abpm.9.8\\)c0`\n- `am7510-00_firmware 5.63\\(acor.0.2\\)c0`\n- `ax7501-b1_firmware 5.17\\(abpc.7.2\\)c0`\n- `pe3301-00_firmware 5.63\\(acmt.3.1\\)c0`\n- `pe5301-01_firmware 5.63\\(acoj.3.1\\)c0`\n- `px5301-t0_firmware 5.44\\(ackb.0.7\\)c0`\n- `px5302-00_firmware 5.44\\(acnm.0.1\\)c0`\n- `we3300-00_firmware 5.70\\(acka.2\\)c0`\n- `we4600-00_firmware 6.70\\(ackt.1\\)c0`\n- `wx5600-t0_firmware 5.70\\(aceb.6\\)c0`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}