---
id: CVE-2026-1460
title: >-
  A post-authentication command injection vulnerability in the “DomainName”
  parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0
  firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated
  attacker with adm…
summary: >-
  A post-authentication command injection vulnerability in the “DomainName”
  parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0
  firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated
  attacker with adm…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: zyxel
product: nebula_fwa70_firmware
affected:
  - nebula_fwa70_firmware < 1.51\(acrf.0\)v0
  - nebula_fwa505_firmware < 1.60\(acko.3\)v0
  - nebula_fwa510_firmware < 1.60\(acgd.1\)v0
  - nebula_fwa515_firmware < 1.60\(acpz.1\)v0
  - nebula_fwa710_firmware < 1.60\(acgc.2\)v0
  - nebula_lte3301-plus_firmware < 1.18\(acca.7\)v0
  - nebula_lte7461-m602_firmware < 1.15\(acev.4\)v0
  - nebula_nr5101_firmware < 1.16\(accg.1\)v0
  - nebula_nr7101_firmware < 1.16\(accc.2\)v0
  - dx3300-t0_firmware < 5.50\(abvy.7.2\)c0
  - dx3300-t1_firmware < 5.50\(abvy.7.2\)c0
  - dx3301-t0_firmware < 5.50\(abvy.7.2\)c0
  - dx5401-b1_firmware < 5.17\(abyo.7.2\)c0
  - ee3301-00_firmware < 5.63\(acmu.3.1\)c0
  - ee5301-00_firmware < 5.63\(acld.3.1\)c0
  - ee6510-10_firmware < 5.19\(acjq.4.2\)c0
  - emg3525-t50b_firmware < 5.50\(abpm.9.8\)c0
  - emg5523-t50b_firmware < 5.50\(abpm.9.8\)c0
  - ex2210-t0_firmware < 5.50\(acdi.2.5\)c0
  - ex3300-t0_firmware < 5.50\(abvy.7.2\)c0
  - ex3300-t1_firmware < 5.50\(abvy.7.2\)c0
  - ex3301-t0_firmware < 5.50\(abvy.7.2\)c0
  - ex3500-t0_firmware < 5.44\(achr.6\)c0
  - ex3501-t0_firmware < 5.44\(achr.6\)c0
  - ex3600-t0_firmware < 5.70\(acif.3\)c0
  - ex5401-b1_firmware < 5.17\(abyo.7.2\)c0
  - ex5512-t0_firmware < 5.70\(aceg.5.5\)c0
  - ex5601-t0_firmware < 5.70\(acdz.6\)c0
  - ex5601-t1_firmware < 5.70\(acdz.6\)c0
  - ex7501-b0_firmware < 5.18\(achn.3.2\)c0
  - ex7710-b0_firmware < 5.18\(acak.1.7\)c0
  - gm4100-b0_firmware < 5.18\(accl.2.1\)c0
  - vmg3625-t50b_firmware < 5.50\(abpm.9.8\)c0
  - vmg4005-b50a_firmware < 5.17\(abqa.3.3\)c0
  - vmg4005-b60a_firmware < 5.17\(abqa.3.3\)c0
  - vmg8623-t50b_firmware < 5.50\(abpm.9.8\)c0
  - am7510-00_firmware < 5.63\(acor.0.2\)c0
  - ax7501-b1_firmware < 5.17\(abpc.7.2\)c0
  - pe3301-00_firmware < 5.63\(acmt.3.1\)c0
  - pe5301-01_firmware < 5.63\(acoj.3.1\)c0
  - px5301-t0_firmware < 5.44\(ackb.0.7\)c0
  - px5302-00_firmware < 5.44\(acnm.0.1\)c0
  - we3300-00_firmware < 5.70\(acka.2\)c0
  - we4600-00_firmware < 6.70\(ackt.1\)c0
  - wx5600-t0_firmware < 5.70\(aceb.6\)c0
patched:
  - nebula_fwa70_firmware 1.51\(acrf.0\)v0
  - nebula_fwa505_firmware 1.60\(acko.3\)v0
  - nebula_fwa510_firmware 1.60\(acgd.1\)v0
  - nebula_fwa515_firmware 1.60\(acpz.1\)v0
  - nebula_fwa710_firmware 1.60\(acgc.2\)v0
  - nebula_lte3301-plus_firmware 1.18\(acca.7\)v0
  - nebula_lte7461-m602_firmware 1.15\(acev.4\)v0
  - nebula_nr5101_firmware 1.16\(accg.1\)v0
  - nebula_nr7101_firmware 1.16\(accc.2\)v0
  - dx3300-t0_firmware 5.50\(abvy.7.2\)c0
  - dx3300-t1_firmware 5.50\(abvy.7.2\)c0
  - dx3301-t0_firmware 5.50\(abvy.7.2\)c0
  - dx5401-b1_firmware 5.17\(abyo.7.2\)c0
  - ee3301-00_firmware 5.63\(acmu.3.1\)c0
  - ee5301-00_firmware 5.63\(acld.3.1\)c0
  - ee6510-10_firmware 5.19\(acjq.4.2\)c0
  - emg3525-t50b_firmware 5.50\(abpm.9.8\)c0
  - emg5523-t50b_firmware 5.50\(abpm.9.8\)c0
  - ex2210-t0_firmware 5.50\(acdi.2.5\)c0
  - ex3300-t0_firmware 5.50\(abvy.7.2\)c0
  - ex3300-t1_firmware 5.50\(abvy.7.2\)c0
  - ex3301-t0_firmware 5.50\(abvy.7.2\)c0
  - ex3500-t0_firmware 5.44\(achr.6\)c0
  - ex3501-t0_firmware 5.44\(achr.6\)c0
  - ex3600-t0_firmware 5.70\(acif.3\)c0
  - ex5401-b1_firmware 5.17\(abyo.7.2\)c0
  - ex5512-t0_firmware 5.70\(aceg.5.5\)c0
  - ex5601-t0_firmware 5.70\(acdz.6\)c0
  - ex5601-t1_firmware 5.70\(acdz.6\)c0
  - ex7501-b0_firmware 5.18\(achn.3.2\)c0
  - ex7710-b0_firmware 5.18\(acak.1.7\)c0
  - gm4100-b0_firmware 5.18\(accl.2.1\)c0
  - vmg3625-t50b_firmware 5.50\(abpm.9.8\)c0
  - vmg4005-b50a_firmware 5.17\(abqa.3.3\)c0
  - vmg4005-b60a_firmware 5.17\(abqa.3.3\)c0
  - vmg8623-t50b_firmware 5.50\(abpm.9.8\)c0
  - am7510-00_firmware 5.63\(acor.0.2\)c0
  - ax7501-b1_firmware 5.17\(abpc.7.2\)c0
  - pe3301-00_firmware 5.63\(acmt.3.1\)c0
  - pe5301-01_firmware 5.63\(acoj.3.1\)c0
  - px5301-t0_firmware 5.44\(ackb.0.7\)c0
  - px5302-00_firmware 5.44\(acnm.0.1\)c0
  - we3300-00_firmware 5.70\(acka.2\)c0
  - we4600-00_firmware 6.70\(ackt.1\)c0
  - wx5600-t0_firmware 5.70\(aceb.6\)c0
published: '2026-04-28'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-1460'
references:
  - url: >-
      https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026
    label: security@zyxel.com.tw
tags:
  - nvd
epss: 0.01157
epssPercentile: 0.65662
ingestedAt: '2026-07-08T15:51:20.910Z'
---

## Overview

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

## Affected

- `nebula_fwa70_firmware < 1.51\(acrf.0\)v0`
- `nebula_fwa505_firmware < 1.60\(acko.3\)v0`
- `nebula_fwa510_firmware < 1.60\(acgd.1\)v0`
- `nebula_fwa515_firmware < 1.60\(acpz.1\)v0`
- `nebula_fwa710_firmware < 1.60\(acgc.2\)v0`
- `nebula_lte3301-plus_firmware < 1.18\(acca.7\)v0`
- `nebula_lte7461-m602_firmware < 1.15\(acev.4\)v0`
- `nebula_nr5101_firmware < 1.16\(accg.1\)v0`
- `nebula_nr7101_firmware < 1.16\(accc.2\)v0`
- `dx3300-t0_firmware < 5.50\(abvy.7.2\)c0`
- `dx3300-t1_firmware < 5.50\(abvy.7.2\)c0`
- `dx3301-t0_firmware < 5.50\(abvy.7.2\)c0`
- `dx5401-b1_firmware < 5.17\(abyo.7.2\)c0`
- `ee3301-00_firmware < 5.63\(acmu.3.1\)c0`
- `ee5301-00_firmware < 5.63\(acld.3.1\)c0`
- `ee6510-10_firmware < 5.19\(acjq.4.2\)c0`
- `emg3525-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `emg5523-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `ex2210-t0_firmware < 5.50\(acdi.2.5\)c0`
- `ex3300-t0_firmware < 5.50\(abvy.7.2\)c0`
- `ex3300-t1_firmware < 5.50\(abvy.7.2\)c0`
- `ex3301-t0_firmware < 5.50\(abvy.7.2\)c0`
- `ex3500-t0_firmware < 5.44\(achr.6\)c0`
- `ex3501-t0_firmware < 5.44\(achr.6\)c0`
- `ex3600-t0_firmware < 5.70\(acif.3\)c0`
- `ex5401-b1_firmware < 5.17\(abyo.7.2\)c0`
- `ex5512-t0_firmware < 5.70\(aceg.5.5\)c0`
- `ex5601-t0_firmware < 5.70\(acdz.6\)c0`
- `ex5601-t1_firmware < 5.70\(acdz.6\)c0`
- `ex7501-b0_firmware < 5.18\(achn.3.2\)c0`
- `ex7710-b0_firmware < 5.18\(acak.1.7\)c0`
- `gm4100-b0_firmware < 5.18\(accl.2.1\)c0`
- `vmg3625-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `vmg4005-b50a_firmware < 5.17\(abqa.3.3\)c0`
- `vmg4005-b60a_firmware < 5.17\(abqa.3.3\)c0`
- `vmg8623-t50b_firmware < 5.50\(abpm.9.8\)c0`
- `am7510-00_firmware < 5.63\(acor.0.2\)c0`
- `ax7501-b1_firmware < 5.17\(abpc.7.2\)c0`
- `pe3301-00_firmware < 5.63\(acmt.3.1\)c0`
- `pe5301-01_firmware < 5.63\(acoj.3.1\)c0`
- `px5301-t0_firmware < 5.44\(ackb.0.7\)c0`
- `px5302-00_firmware < 5.44\(acnm.0.1\)c0`
- `we3300-00_firmware < 5.70\(acka.2\)c0`
- `we4600-00_firmware < 6.70\(ackt.1\)c0`
- `wx5600-t0_firmware < 5.70\(aceb.6\)c0`

## Remediation

Upgrade past the affected range:

- `nebula_fwa70_firmware 1.51\(acrf.0\)v0`
- `nebula_fwa505_firmware 1.60\(acko.3\)v0`
- `nebula_fwa510_firmware 1.60\(acgd.1\)v0`
- `nebula_fwa515_firmware 1.60\(acpz.1\)v0`
- `nebula_fwa710_firmware 1.60\(acgc.2\)v0`
- `nebula_lte3301-plus_firmware 1.18\(acca.7\)v0`
- `nebula_lte7461-m602_firmware 1.15\(acev.4\)v0`
- `nebula_nr5101_firmware 1.16\(accg.1\)v0`
- `nebula_nr7101_firmware 1.16\(accc.2\)v0`
- `dx3300-t0_firmware 5.50\(abvy.7.2\)c0`
- `dx3300-t1_firmware 5.50\(abvy.7.2\)c0`
- `dx3301-t0_firmware 5.50\(abvy.7.2\)c0`
- `dx5401-b1_firmware 5.17\(abyo.7.2\)c0`
- `ee3301-00_firmware 5.63\(acmu.3.1\)c0`
- `ee5301-00_firmware 5.63\(acld.3.1\)c0`
- `ee6510-10_firmware 5.19\(acjq.4.2\)c0`
- `emg3525-t50b_firmware 5.50\(abpm.9.8\)c0`
- `emg5523-t50b_firmware 5.50\(abpm.9.8\)c0`
- `ex2210-t0_firmware 5.50\(acdi.2.5\)c0`
- `ex3300-t0_firmware 5.50\(abvy.7.2\)c0`
- `ex3300-t1_firmware 5.50\(abvy.7.2\)c0`
- `ex3301-t0_firmware 5.50\(abvy.7.2\)c0`
- `ex3500-t0_firmware 5.44\(achr.6\)c0`
- `ex3501-t0_firmware 5.44\(achr.6\)c0`
- `ex3600-t0_firmware 5.70\(acif.3\)c0`
- `ex5401-b1_firmware 5.17\(abyo.7.2\)c0`
- `ex5512-t0_firmware 5.70\(aceg.5.5\)c0`
- `ex5601-t0_firmware 5.70\(acdz.6\)c0`
- `ex5601-t1_firmware 5.70\(acdz.6\)c0`
- `ex7501-b0_firmware 5.18\(achn.3.2\)c0`
- `ex7710-b0_firmware 5.18\(acak.1.7\)c0`
- `gm4100-b0_firmware 5.18\(accl.2.1\)c0`
- `vmg3625-t50b_firmware 5.50\(abpm.9.8\)c0`
- `vmg4005-b50a_firmware 5.17\(abqa.3.3\)c0`
- `vmg4005-b60a_firmware 5.17\(abqa.3.3\)c0`
- `vmg8623-t50b_firmware 5.50\(abpm.9.8\)c0`
- `am7510-00_firmware 5.63\(acor.0.2\)c0`
- `ax7501-b1_firmware 5.17\(abpc.7.2\)c0`
- `pe3301-00_firmware 5.63\(acmt.3.1\)c0`
- `pe5301-01_firmware 5.63\(acoj.3.1\)c0`
- `px5301-t0_firmware 5.44\(ackb.0.7\)c0`
- `px5302-00_firmware 5.44\(acnm.0.1\)c0`
- `we3300-00_firmware 5.70\(acka.2\)c0`
- `we4600-00_firmware 6.70\(ackt.1\)c0`
- `wx5600-t0_firmware 5.70\(aceb.6\)c0`