high7.2
CVE-2026-1460
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware ve…
Impact
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Nebula Fwa70 Firmware | before 1.51\(acrf.0\)v0 |
| Zyxel | Nebula Fwa505 Firmware | before 1.60\(acko.3\)v0 |
| Zyxel | Nebula Fwa510 Firmware | before 1.60\(acgd.1\)v0 |
| Zyxel | Nebula Fwa515 Firmware | before 1.60\(acpz.1\)v0 |
| Zyxel | Nebula Fwa710 Firmware | before 1.60\(acgc.2\)v0 |
| Zyxel | Nebula Lte3301-Plus Firmware | before 1.18\(acca.7\)v0 |
| Zyxel | Nebula Lte7461-M602 Firmware | before 1.15\(acev.4\)v0 |
| Zyxel | Nebula Nr5101 Firmware | before 1.16\(accg.1\)v0 |
| Zyxel | Nebula Nr7101 Firmware | before 1.16\(accc.2\)v0 |
| Zyxel | Dx3300-T0 Firmware | before 5.50\(abvy.7.2\)c0 |
| Zyxel | Dx3300-T1 Firmware | before 5.50\(abvy.7.2\)c0 |
| Zyxel | Dx3301-T0 Firmware | before 5.50\(abvy.7.2\)c0 |