ZeroDay Findings
Sign inSign up

Findings

CVE-2026-1460

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions t…

Published Apr 28, 2026 · updated Jul 25, 2026 · zyxel nebula fwa70 firmware

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 28, 2026 · NIST NVD

    Detected

    A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

  2. Jul 25, 2026 · NIST NVD

    Updated

    A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

Affected

  • cpe zyxel/dx3300-t0 firmwareversion unspecified
  • cpe zyxel/dx3300-t1 firmwareversion unspecified
  • cpe zyxel/dx3301-t0 firmwareversion unspecified
  • cpe zyxel/nebula fwa505 firmwareversion unspecified
  • cpe zyxel/nebula fwa510 firmwareversion unspecified
  • cpe zyxel/nebula fwa515 firmwareversion unspecified
  • cpe zyxel/nebula fwa70 firmwareversion unspecified
  • cpe zyxel/nebula fwa710 firmwareversion unspecified
  • cpe zyxel/nebula lte3301-plus firmwareversion unspecified
  • cpe zyxel/nebula lte7461-m602 firmwareversion unspecified
  • cpe zyxel/nebula nr5101 firmwareversion unspecified
  • cpe zyxel/nebula nr7101 firmwareversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-1460

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-1460

    A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS command

    nvd.nist.gov

References