Volerion logoVolerion
Volerion logoVolerion

Zyxel DX3300-T0 Command Injection Vulnerability in EasyMesh APIs

Vulnerability

A command injection vulnerability has been identified in the EasyMesh-related APIs of the Zyxel DX3300-T0 firmware, affecting versions through 5.50(ABVY.7.1)C0. This vulnerability allows an authenticated, adjacent attacker with administrator privileges to execute operating system commands on the affected device. The issue arises from the handling of certain API requests, which can be manipulated to inject and execute commands on the device's operating system.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected device's operating system, potentially allowing an attacker to manipulate the device's functions or access sensitive information.

Remediation

Users are advised to update to version 5.50(ABVY.7.2)C0. For devices acquired through an ISP, contact the ISP's support team. For other devices, reach out to the local Zyxel support team or visit Zyxel's Community for assistance.

Added: Apr 28, 2026, 3:23 AM
Updated: Apr 28, 2026, 3:23 AM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
7.5
exploitability
3.0
remediation
7.7
relevance
6.9
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.