---
id: CVE-2026-0711
title: >-
  A post-authentication command injection vulnerability in the EasyMesh-related
  APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow
  an authenticated, adjacent attacker with administrator privileges to execute
  OS …
summary: >-
  A post-authentication command injection vulnerability in the EasyMesh-related
  APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow
  an authenticated, adjacent attacker with administrator privileges to execute
  OS …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: zyxel
product: nr5307_firmware
affected:
  - nr5307_firmware < 2.00\(acjt.3\)c0
  - nebula_fwa515_firmware < 1.60\(acpz.0\)v0
  - dx3300-t0_firmware < 5.50\(abvy.7.2\)c0
  - dx3300-t1_firmware < 5.50\(abvy.7.2\)c0
  - dx3301-t0_firmware < 5.50\(abvy.7.2\)c0
  - dx5401-b0_firmware < 5.17\(abyo.7.2\)c0
  - dx5401-b1_firmware < 5.17\(abyo.7.2\)c0
  - ee3301-00_firmware < 5.63\(acmu.3.1\)c0
  - ee5301-00_firmware < 5.63\(acld.3.1\)c0
  - ee6510-10_firmware < 5.19\(acjq.4.2\)c0
  - emg3525-t50b_firmware < 5.50\(abpm.9.8\)c0
  - emg5523-t50b_firmware < 5.50\(abpm.9.8\)c0
  - ex3300-t0_firmware < 5.50\(abvy.7.2\)c0
  - ex3300-t1_firmware < 5.50\(abvy.7.2\)c0
  - ex3301-t0_firmware < 5.50\(abvy.7.2\)c0
  - ex3500-t0_firmware < 5.44\(achr.6\)c0
  - ex3501-t0_firmware < 5.44\(achr.6\)c0
  - ex3600-t0_firmware < 5.70\(acif.3\)c0
  - ex5401-b0_firmware < 5.17\(abyo.7.2\)c0
  - ex5401-b1_firmware < 5.17\(abyo.7.2\)c0
  - ex5512-t0_firmware < 5.70\(aceg.5.5\)c0
  - ex5601-t0_firmware < 5.70\(acdz.6\)c0
  - ex5601-t1_firmware < 5.70\(acdz.6\)c0
  - ex7501-b0_firmware < 5.18\(achn.3.2\)c0
  - vmg3625-t50b_firmware < 5.50\(abpm.9.8\)c0
  - vmg8623-t50b_firmware < 5.50\(abpm.9.8\)c0
  - ax7501-b0_firmware < 5.17\(abpc.7.2\)c0
  - ax7501-b1_firmware < 5.17\(abpc.7.2\)c0
  - pe3301-00_firmware < 5.63\(acmt.3.1\)c0
  - pe5301-01_firmware < 5.63\(acoj.3.1\)c0
  - px5302-00_firmware < 5.44\(acnm.0.1\)c0
  - px5301-t0_firmware < 5.44\(ackb.0.7\)c0
  - we3300-00_firmware < 5.70\(acka.2\)c0
  - wx3100-t0_firmware < 5.50\(abvl.4.10\)c0
  - we4600-00_firmware < 6.70\(ackt.1\)c0
  - wx5600-t0_firmware < 5.70\(aceb.6\)c0
patched:
  - nr5307_firmware 2.00\(acjt.3\)c0
  - nebula_fwa515_firmware 1.60\(acpz.0\)v0
  - dx3300-t0_firmware 5.50\(abvy.7.2\)c0
  - dx3300-t1_firmware 5.50\(abvy.7.2\)c0
  - dx3301-t0_firmware 5.50\(abvy.7.2\)c0
  - dx5401-b0_firmware 5.17\(abyo.7.2\)c0
  - dx5401-b1_firmware 5.17\(abyo.7.2\)c0
  - ee3301-00_firmware 5.63\(acmu.3.1\)c0
  - ee5301-00_firmware 5.63\(acld.3.1\)c0
  - ee6510-10_firmware 5.19\(acjq.4.2\)c0
  - emg3525-t50b_firmware 5.50\(abpm.9.8\)c0
  - emg5523-t50b_firmware 5.50\(abpm.9.8\)c0
  - ex3300-t0_firmware 5.50\(abvy.7.2\)c0
  - ex3300-t1_firmware 5.50\(abvy.7.2\)c0
  - ex3301-t0_firmware 5.50\(abvy.7.2\)c0
  - ex3500-t0_firmware 5.44\(achr.6\)c0
  - ex3501-t0_firmware 5.44\(achr.6\)c0
  - ex3600-t0_firmware 5.70\(acif.3\)c0
  - ex5401-b0_firmware 5.17\(abyo.7.2\)c0
  - ex5401-b1_firmware 5.17\(abyo.7.2\)c0
  - ex5512-t0_firmware 5.70\(aceg.5.5\)c0
  - ex5601-t0_firmware 5.70\(acdz.6\)c0
  - ex5601-t1_firmware 5.70\(acdz.6\)c0
  - ex7501-b0_firmware 5.18\(achn.3.2\)c0
  - vmg3625-t50b_firmware 5.50\(abpm.9.8\)c0
  - vmg8623-t50b_firmware 5.50\(abpm.9.8\)c0
  - ax7501-b0_firmware 5.17\(abpc.7.2\)c0
  - ax7501-b1_firmware 5.17\(abpc.7.2\)c0
  - pe3301-00_firmware 5.63\(acmt.3.1\)c0
  - pe5301-01_firmware 5.63\(acoj.3.1\)c0
  - px5302-00_firmware 5.44\(acnm.0.1\)c0
  - px5301-t0_firmware 5.44\(ackb.0.7\)c0
  - we3300-00_firmware 5.70\(acka.2\)c0
  - wx3100-t0_firmware 5.50\(abvl.4.10\)c0
  - we4600-00_firmware 6.70\(ackt.1\)c0
  - wx5600-t0_firmware 5.70\(aceb.6\)c0
published: '2026-04-28'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0711'
references:
  - url: >-
      https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026
    label: security@zyxel.com.tw
tags:
  - nvd
epss: 0.00849
epssPercentile: 0.56128
ingestedAt: '2026-07-08T15:51:20.904Z'
---

## Overview

A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device.

## Affected

- `nr5307_firmware < 2.00\(acjt.3\)c0`
- `nebula_fwa515_firmware < 1.60\(acpz.0\)v0`
- `dx3300-t0_firmware < 5.50\(abvy.7.2\)c0`
- `dx3300-t1_firmware < 5.50\(abvy.7.2\)c0`
- `dx3301-t0_firmware < 5.50\(abvy.7.2\)c0`
- `dx5401-b0_firmware < 5.17\(abyo.7.2\)c0`
- `dx5401-b1_firmware < 5.17\(abyo.7.2\)c0`
- `ee3301-00_firmware < 5.63\(acmu.3.1\)c0`
- `ee5301-00_firmware < 5.63\(acld.3.1\)c0`
- `ee6510-10_firmware < 5.19\(acjq.4.2\)c0`
- `emg3525-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `emg5523-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `ex3300-t0_firmware < 5.50\(abvy.7.2\)c0`
- `ex3300-t1_firmware < 5.50\(abvy.7.2\)c0`
- `ex3301-t0_firmware < 5.50\(abvy.7.2\)c0`
- `ex3500-t0_firmware < 5.44\(achr.6\)c0`
- `ex3501-t0_firmware < 5.44\(achr.6\)c0`
- `ex3600-t0_firmware < 5.70\(acif.3\)c0`
- `ex5401-b0_firmware < 5.17\(abyo.7.2\)c0`
- `ex5401-b1_firmware < 5.17\(abyo.7.2\)c0`
- `ex5512-t0_firmware < 5.70\(aceg.5.5\)c0`
- `ex5601-t0_firmware < 5.70\(acdz.6\)c0`
- `ex5601-t1_firmware < 5.70\(acdz.6\)c0`
- `ex7501-b0_firmware < 5.18\(achn.3.2\)c0`
- `vmg3625-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `vmg8623-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `ax7501-b0_firmware < 5.17\(abpc.7.2\)c0`
- `ax7501-b1_firmware < 5.17\(abpc.7.2\)c0`
- `pe3301-00_firmware < 5.63\(acmt.3.1\)c0`
- `pe5301-01_firmware < 5.63\(acoj.3.1\)c0`
- `px5302-00_firmware < 5.44\(acnm.0.1\)c0`
- `px5301-t0_firmware < 5.44\(ackb.0.7\)c0`
- `we3300-00_firmware < 5.70\(acka.2\)c0`
- `wx3100-t0_firmware < 5.50\(abvl.4.10\)c0`
- `we4600-00_firmware < 6.70\(ackt.1\)c0`
- `wx5600-t0_firmware < 5.70\(aceb.6\)c0`

## Remediation

Upgrade past the affected range:

- `nr5307_firmware 2.00\(acjt.3\)c0`
- `nebula_fwa515_firmware 1.60\(acpz.0\)v0`
- `dx3300-t0_firmware 5.50\(abvy.7.2\)c0`
- `dx3300-t1_firmware 5.50\(abvy.7.2\)c0`
- `dx3301-t0_firmware 5.50\(abvy.7.2\)c0`
- `dx5401-b0_firmware 5.17\(abyo.7.2\)c0`
- `dx5401-b1_firmware 5.17\(abyo.7.2\)c0`
- `ee3301-00_firmware 5.63\(acmu.3.1\)c0`
- `ee5301-00_firmware 5.63\(acld.3.1\)c0`
- `ee6510-10_firmware 5.19\(acjq.4.2\)c0`
- `emg3525-t50b_firmware 5.50\(abpm.9.8\)c0`
- `emg5523-t50b_firmware 5.50\(abpm.9.8\)c0`
- `ex3300-t0_firmware 5.50\(abvy.7.2\)c0`
- `ex3300-t1_firmware 5.50\(abvy.7.2\)c0`
- `ex3301-t0_firmware 5.50\(abvy.7.2\)c0`
- `ex3500-t0_firmware 5.44\(achr.6\)c0`
- `ex3501-t0_firmware 5.44\(achr.6\)c0`
- `ex3600-t0_firmware 5.70\(acif.3\)c0`
- `ex5401-b0_firmware 5.17\(abyo.7.2\)c0`
- `ex5401-b1_firmware 5.17\(abyo.7.2\)c0`
- `ex5512-t0_firmware 5.70\(aceg.5.5\)c0`
- `ex5601-t0_firmware 5.70\(acdz.6\)c0`
- `ex5601-t1_firmware 5.70\(acdz.6\)c0`
- `ex7501-b0_firmware 5.18\(achn.3.2\)c0`
- `vmg3625-t50b_firmware 5.50\(abpm.9.8\)c0`
- `vmg8623-t50b_firmware 5.50\(abpm.9.8\)c0`
- `ax7501-b0_firmware 5.17\(abpc.7.2\)c0`
- `ax7501-b1_firmware 5.17\(abpc.7.2\)c0`
- `pe3301-00_firmware 5.63\(acmt.3.1\)c0`
- `pe5301-01_firmware 5.63\(acoj.3.1\)c0`
- `px5302-00_firmware 5.44\(acnm.0.1\)c0`
- `px5301-t0_firmware 5.44\(ackb.0.7\)c0`
- `we3300-00_firmware 5.70\(acka.2\)c0`
- `wx3100-t0_firmware 5.50\(abvl.4.10\)c0`
- `we4600-00_firmware 6.70\(ackt.1\)c0`
- `wx5600-t0_firmware 5.70\(aceb.6\)c0`