CVE-2026-1460

highpriority · track · 0EPSS 0.012 · 67 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.16% (67th) EPSS

CVSS 7.2 · high

Is it mine?

47 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-23

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

cvss

Technical severity, 0–10. One row per scoring source.

7.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · security@zyxel.com.twexploitability 1.2 · impact 5.9

v3.16.6mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78US

affected products (47)

Products and version ranges known to be affected.

Zyxel DX3301-T0 firmware≤ ≤ 5.50(ABVY.7.1)C0enisa_euvdEU
Zyxel EX3301-T0 firmware≤ ≤ 5.50(ABVY.7.1)C0enisa_euvdEU
zyxel am7510-00 firmware< 5.63\(acor.0.2\)c0nvdUScpe:2.3:o:zyxel:am7510-00_firmware:*:*:*:*:*:*:*:*
zyxel ax7501-b1 firmware< 5.17\(abpc.7.2\)c0nvdUScpe:2.3:o:zyxel:ax7501-b1_firmware:*:*:*:*:*:*:*:*
zyxel dx3300-t0 firmware< 5.50\(abvy.7.2\)c0nvdUScpe:2.3:o:zyxel:dx3300-t0_firmware:*:*:*:*:*:*:*:*
zyxel dx3300-t1 firmware< 5.50\(abvy.7.2\)c0nvdUScpe:2.3:o:zyxel:dx3300-t1_firmware:*:*:*:*:*:*:*:*
zyxel dx3301-t0 firmware< 5.50\(abvy.7.2\)c0nvdUScpe:2.3:o:zyxel:dx3301-t0_firmware:*:*:*:*:*:*:*:*
zyxel dx5401-b1 firmware< 5.17\(abyo.7.2\)c0nvdUScpe:2.3:o:zyxel:dx5401-b1_firmware:*:*:*:*:*:*:*:*
zyxel ee3301-00 firmware< 5.63\(acmu.3.1\)c0nvdUScpe:2.3:o:zyxel:ee3301-00_firmware:*:*:*:*:*:*:*:*
zyxel ee5301-00 firmware< 5.63\(acld.3.1\)c0nvdUScpe:2.3:o:zyxel:ee5301-00_firmware:*:*:*:*:*:*:*:*
zyxel ee6510-10 firmware< 5.19\(acjq.4.2\)c0nvdUScpe:2.3:o:zyxel:ee6510-10_firmware:*:*:*:*:*:*:*:*
zyxel emg3525-t50b firmware< 5.50\(abpm.9.8\)c0nvdUScpe:2.3:o:zyxel:emg3525-t50b_firmware:*:*:*:*:*:*:*:*
zyxel emg5523-t50b firmware< 5.50\(abpm.9.8\)c0nvdUScpe:2.3:o:zyxel:emg5523-t50b_firmware:*:*:*:*:*:*:*:*
zyxel ex2210-t0 firmware< 5.50\(acdi.2.5\)c0nvdUScpe:2.3:o:zyxel:ex2210-t0_firmware:*:*:*:*:*:*:*:*
zyxel ex3300-t0 firmware< 5.50\(abvy.7.2\)c0nvdUScpe:2.3:o:zyxel:ex3300-t0_firmware:*:*:*:*:*:*:*:*
zyxel ex3300-t1 firmware< 5.50\(abvy.7.2\)c0nvdUScpe:2.3:o:zyxel:ex3300-t1_firmware:*:*:*:*:*:*:*:*
zyxel ex3301-t0 firmware< 5.50\(abvy.7.2\)c0nvdUScpe:2.3:o:zyxel:ex3301-t0_firmware:*:*:*:*:*:*:*:*
zyxel ex3500-t0 firmware< 5.44\(achr.6\)c0nvdUScpe:2.3:o:zyxel:ex3500-t0_firmware:*:*:*:*:*:*:*:*
zyxel ex3501-t0 firmware< 5.44\(achr.6\)c0nvdUScpe:2.3:o:zyxel:ex3501-t0_firmware:*:*:*:*:*:*:*:*
zyxel ex3600-t0 firmware< 5.70\(acif.3\)c0nvdUScpe:2.3:o:zyxel:ex3600-t0_firmware:*:*:*:*:*:*:*:*

showing 20 of 47

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2026-04-28modified 2026-07-25

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan