PT-2026-35646 · Zyxel · Ex3301-T0+1

Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-1460

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel DX3301-T0 versions prior to 5.50(ABVY.7.1)C0 Zyxel EX3301-T0 versions prior to 5.50(ABVY.7.1)C0

Description A post-authentication command injection issue exists in the DHCP configuration file. An authenticated attacker with administrator privileges can execute operating system commands on the device by manipulating the DomainName parameter.

Recommendations Update to version 5.50(ABVY.7.1)C0 or later. Avoid using the DomainName parameter in the DHCP configuration file until the update is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-1460

Affected Products

Dx3301-T0

Ex3301-T0

References · 5

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1460 · Security Note
• https://twitter.com/Watchful_IP/status/2049045589438976043 · Twitter Post
• https://twitter.com/CVEarity/status/2049102390268473827 · Twitter Post
• https://t.me/CVEtracker/52030 · Telegram Post