CVE-2026-1460

HighRCE

Published: 28 April 2026

Published

28 April 2026

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0025 48.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1460 is a high-severity OS Command Injection (CWE-78) vulnerability in Zyxel DX3301-T0 (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 48.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Unix Shell (T1059.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates command injection in the DomainName parameter by requiring input validation mechanisms at configuration file processing points.

SI-2 Flaw Remediation good match

prevent

Ensures timely flaw remediation through firmware patching as advised by Zyxel for this specific command injection vulnerability.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to limit the scope of arbitrary OS command execution even if an administrator exploits the post-authentication vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

Post-auth command injection (CWE-78) in DHCP config directly enables arbitrary Unix shell command execution on the device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

Deeper analysisAI

CVE-2026-1460 is a post-authentication command injection vulnerability (CWE-78) in the "DomainName" parameter of the DHCP configuration file within Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0. It enables arbitrary OS command execution on affected devices and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete compromise despite requiring elevated privileges.

An authenticated attacker possessing administrator privileges can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation allows execution of arbitrary operating system commands, potentially granting full control over the device, including data exfiltration, modification, or disruption of services.

Zyxel has published a security advisory detailing this and related command injection vulnerabilities in certain 4G LTE, 5G NR CPE, DSL Ethernet CPE, fiber ONTs, and wireless extenders, available at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026. Security practitioners should consult it for specific patch information and mitigation guidance.