Vulnerabilidades do Zyxel Ee3301-00 Firmware

CVE-2026-1460 Alta · 7.2 CWE-78 28/04/2026

OS Command Injection em Zyxel Nebula Fwa70 Firmware

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

CVE-2026-0711 Média · 6.8 CWE-78 28/04/2026

OS Command Injection em Zyxel Nr5307 Firmware

A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device.

CVE-2025-13943 Alta · 8.8 CWE-78 24/02/2026

OS Command Injection em Zyxel Ex5601-t1 Firmware

A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device.

CVE-2025-11848 Média · 4.9 CWE-476 24/02/2026

NULL Pointer Dereference em Zyxel Ex5601-t1 Firmware

A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

CVE-2025-11847 Média · 4.9 CWE-476 24/02/2026

NULL Pointer Dereference em Zyxel Ex3510-b1 Firmware

A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

CVE-2025-11846 Média · 4.9 CWE-476 23/02/2026

NULL Pointer Dereference em Zyxel Lte3301-plus Firmware

A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

CVE-2025-11845 Média · 4.9 CWE-476 23/02/2026

NULL Pointer Dereference em Zyxel Lte3301-plus Firmware

A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

CVE-2025-8693 Alta · 8.8 CWE-78 17/11/2025

OS Command Injection em Zyxel Dm4200-b0 Firmware

A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute operating system (OS) commands on an affected device.

CVE-2025-6599 Alta · 7.5 CWE-400 17/11/2025

Uncontrolled Resource Consumption em Zyxel Lte3301-plus Firmware

An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service (DoS) attacks. Such attacks may temporarily block legitimate HTTP requests and partially disrupt access to the web management interface, while other networking services remain unaffected.