CVE-2026-1460
HIGHCVSS 7.2/10EPSS 1.16%
Last modified
CVE-2026-1460 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.. EPSS estimates a 1.16% chance of exploitation in the next 30 days.
Description
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Nebula Fwa70 Firmware | < 1.51\(acrf.0\)v0 |
| Zyxel | Nebula Fwa505 Firmware | < 1.60\(acko.3\)v0 |
| Zyxel | Nebula Fwa510 Firmware | < 1.60\(acgd.1\)v0 |
| Zyxel | Nebula Fwa515 Firmware | < 1.60\(acpz.1\)v0 |
| Zyxel | Nebula Fwa710 Firmware | < 1.60\(acgc.2\)v0 |
| Zyxel | Nebula Lte3301-Plus Firmware | < 1.18\(acca.7\)v0 |
| Zyxel | Nebula Lte7461-M602 Firmware | < 1.15\(acev.4\)v0 |
| Zyxel | Nebula Nr5101 Firmware | < 1.16\(accg.1\)v0 |
| Zyxel | Nebula Nr7101 Firmware | < 1.16\(accc.2\)v0 |
| Zyxel | Dx3300-T0 Firmware | < 5.50\(abvy.7.2\)c0 |
| Zyxel | Dx3300-T1 Firmware | < 5.50\(abvy.7.2\)c0 |
| Zyxel | Dx3301-T0 Firmware | < 5.50\(abvy.7.2\)c0 |
| Zyxel | Dx5401-B1 Firmware | < 5.17\(abyo.7.2\)c0 |
| Zyxel | Ee3301-00 Firmware | < 5.63\(acmu.3.1\)c0 |
| Zyxel | Ee5301-00 Firmware | < 5.63\(acld.3.1\)c0 |
| Zyxel | Ee6510-10 Firmware | < 5.19\(acjq.4.2\)c0 |
| Zyxel | Emg3525-T50b Firmware | < 5.50\(abpm.9.8\)c0 |
| Zyxel | Emg5523-T50b Firmware | < 5.50\(abpm.9.8\)c0 |
| Zyxel | Ex2210-T0 Firmware | < 5.50\(acdi.2.5\)c0 |
| Zyxel | Ex3300-T0 Firmware | < 5.50\(abvy.7.2\)c0 |
| Zyxel | Ex3300-T1 Firmware | < 5.50\(abvy.7.2\)c0 |
| Zyxel | Ex3301-T0 Firmware | < 5.50\(abvy.7.2\)c0 |
| Zyxel | Ex3500-T0 Firmware | < 5.44\(achr.6\)c0 |
| Zyxel | Ex3501-T0 Firmware | < 5.44\(achr.6\)c0 |
| Zyxel | Ex3600-T0 Firmware | < 5.70\(acif.3\)c0 |
| Zyxel | Ex5401-B1 Firmware | < 5.17\(abyo.7.2\)c0 |
| Zyxel | Ex5512-T0 Firmware | < 5.70\(aceg.5.5\)c0 |
| Zyxel | Ex5601-T0 Firmware | < 5.70\(acdz.6\)c0 |
| Zyxel | Ex5601-T1 Firmware | < 5.70\(acdz.6\)c0 |
| Zyxel | Ex7501-B0 Firmware | < 5.18\(achn.3.2\)c0 |
| Zyxel | Ex7710-B0 Firmware | < 5.18\(acak.1.7\)c0 |
| Zyxel | Gm4100-B0 Firmware | < 5.18\(accl.2.1\)c0 |
| Zyxel | Vmg3625-T50b Firmware | < 5.50\(abpm.9.8\)c0 |
| Zyxel | Vmg4005-B50a Firmware | < 5.17\(abqa.3.3\)c0 |
| Zyxel | Vmg4005-B60a Firmware | < 5.17\(abqa.3.3\)c0 |
| Zyxel | Vmg8623-T50b Firmware | < 5.50\(abpm.9.8\)c0 |
| Zyxel | Am7510-00 Firmware | < 5.63\(acor.0.2\)c0 |
| Zyxel | Ax7501-B1 Firmware | < 5.17\(abpc.7.2\)c0 |
| Zyxel | Pe3301-00 Firmware | < 5.63\(acmt.3.1\)c0 |
| Zyxel | Pe5301-01 Firmware | < 5.63\(acoj.3.1\)c0 |
| Zyxel | Px5301-T0 Firmware | < 5.44\(ackb.0.7\)c0 |
| Zyxel | Px5302-00 Firmware | < 5.44\(acnm.0.1\)c0 |
| Zyxel | We3300-00 Firmware | < 5.70\(acka.2\)c0 |
| Zyxel | We4600-00 Firmware | < 6.70\(ackt.1\)c0 |
| Zyxel | Wx5600-T0 Firmware | < 5.70\(aceb.6\)c0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-1460?
A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
How severe is CVE-2026-1460?
CVE-2026-1460 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 1.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-1460?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1458GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
- CVE-2026-14586In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in …5.9
- CVE-2026-14587Neo4j's Bolt modern handshake decoder treats an overlong cap…5.5
- CVE-2026-1459A post-authentication command injection vulnerability in the…7.2
- CVE-2026-14592The WP Real IP-based Access Control WordPress plugin through…6.1
- CVE-2026-14596The DynamicKit for Elementor WordPress plugin before 1.0.3 d…8.8
- CVE-2026-14602The Remote API WordPress plugin through 0.2 does not authent…9
- CVE-2026-14603The WowOptin: Next-Gen Popup Maker WordPress plugin before …7.5
- CVE-2026-14604A vulnerability was determined in Open Asset Import Library …6.3
- CVE-2026-14605A vulnerability was identified in RT-Thread up to 5.0.2. Aff…7.8
- CVE-2026-14606A security flaw has been discovered in RT-Thread up to 5.0.2…7.8
- CVE-2026-14607A weakness has been identified in RT-Thread up to 5.0.2. Thi…5.5
Are you affected by CVE-2026-1460?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST