High Β· published November 18, 2025
β‘ Just being logged in isnβt enough! An authenticated user can exploit a command injection flaw in Zyxel DX3300-T0 firmware, letting them send OS commands like a tech-savvy magician pulling rabbits out of hats! π©β¨ Think of this vulnerability like a trusted restaurant employee who can slip into the kitchen and start cooking anything they want without supervision β a recipe for disaster if the wrong person is in the kitchen! An attacker with authenticated access could gain complete control of the device, potentially altering configurations, accessing sensitive data, or installing malicious software. The consequences could be devastating, leading to unauthorized access and a compromised network environment.
Think of this vulnerability like a trusted restaurant employee who can slip into the kitchen and start cooking anything they want without supervision β a recipe for disaster if the wrong person is in the kitchen! This vulnerability allows an authenticated attacker to inject and execute arbitrary OS commands through the 'priv' parameter in the firmware, bypassing normal security checks and gaining elevated privileges.
An attacker with authenticated access could gain complete control of the device, potentially altering configurations, accessing sensitive data, or installing malicious software. The consequences could be devastating, leading to unauthorized access and a compromised network environment. Patch the firmware to version 5.50(ABVY.6.4)C0 or later immediately to close this security gap. Also, review user access controls to ensure that only trusted personnel have authenticated access to the device. You've got this! Take action now to secure your devices, and you'll be a hero in the fight against vulnerabilities! π‘οΈπͺ
| Product | Versions | Fixed in |
|---|---|---|
| zyxel/dm4200-b0_firmware | β€ 5.17\(acbs.1.3\)c0 | β |
| zyxel/dx3300-t0_firmware | β€ 5.50\(abvy.6.3\)c0 | β |
| zyxel/dx3300-t1_firmware | β€ 5.50\(abvy.6.3\)c0 | β |
| zyxel/dx3301-t0_firmware | β€ 5.50\(abvy.6.3\)c0 | β |
| zyxel/dx4510-b1_firmware | β€ 5.17\(abyl.9\)c0 | β |
| zyxel/dx5401-b0_firmware | β€ 5.17\(abyo.7\)b2 | β |
| zyxel/dx5401-b1_firmware | β€ 5.17\(abyo.7\)b2 | β |
| zyxel/ee3301-00_firmware | β€ 5.63\(acmu.1.1\)c0 | β |
| zyxel/ee5301-00_firmware | β€ 5.63\(acld.1.1\)c0 | β |
| zyxel/ee6510-10_firmware | β€ 5.19\(acjq.3\)c0 | β |
| zyxel/ex3300-t0_firmware | β€ 5.50\(abvy.6.3\)c0 | β |
| zyxel/ex3300-t0_firmware | β€ 5.50\(acdi.2.1\)c0 | β |
| zyxel/ex3300-t1_firmware | β€ 5.50\(abvy.6.3\)c0 | β |
| zyxel/ex3301-t0_firmware | β€ 5.50\(abvy.6.3\)c0 | β |
| zyxel/ex3500-t0_firmware | β€ 5.44\(achr.4\)c0 | β |
| zyxel/ex3501-t0_firmware | β€ 5.44\(achr.4\)c0 | β |
| zyxel/ex3510-b0_firmware | β€ 5.17\(abup.15\)c0 | β |
| zyxel/ex3510-b1_firmware | β€ 5.17\(abup.15\)c0 | β |
| zyxel/ex3600-t0_firmware | β€ 5.70\(acif.1.2\)c0 | β |
| zyxel/ex5401-b0_firmware | β€ 5.17\(abyo.7\)b2 | β |
| zyxel/ex5401-b1_firmware | β€ 5.17\(abyo.7\)b2 | β |
| zyxel/ex5501-b0_firmware | β€ 5.17\(abry.5.5\)c0 | β |
| zyxel/ex5510-b0_firmware | β€ 5.17\(abqx.10\)c0 | β |
| zyxel/ex5512-t0_firmware | β€ 5.70\(aceg.5\)c0 | β |
| zyxel/ex5601-t0_firmware | β€ 5.70\(acdz.4.1\)c0 | β |
| zyxel/ex5601-t1_firmware | β€ 5.70\(acdz.4.1\)c0 | β |
| zyxel/ex7501-b0_firmware | β€ 5.18\(achn.2.1\)c0 | β |
| zyxel/ex7710-b0_firmware | β€ 5.18\(acak.1.4\)c0 | β |
| zyxel/emg3525-t50b_firmware | β€ 5.50\(abpm.9.5\)c0 | β |
| zyxel/emg5523-t50b_firmware | β€ 5.50\(abpm.9.5\)c0 | β |
| zyxel/emg5723-t50k_firmware | β€ 5.50\(abom.8.6\)c0 | β |
| zyxel/gm4100-b0_firmware | β€ 5.18\(accl.1\)c0 | β |
| zyxel/vmg3625-t50b_firmware | β€ 5.50\(abpm.9.5\)c0 | β |
| zyxel/vmg3927-t50k_firmware | β€ 5.50\(abom.8.6\)c0 | β |
| zyxel/vmg4005-b50a_firmware | β€ 5.17\(abqa.3\)c0 | β |
| zyxel/vmg4005-b60a_firmware | β€ 5.17\(abqa.3\)c0 | β |
| zyxel/vmg4005-b50b_firmware | β€ 5.13\(abrl.5.3\)c0 | β |
| zyxel/vmg8623-t50b_firmware | β€ 5.50\(abpm.9.5\)c0 | β |
| zyxel/vmg8825-t50k_firmware | β€ 5.50\(abom.8.6\)c0 | β |
| zyxel/ax7501-b0_firmware | β€ 5.17\(abpc.6.1\)c0 | β |
| zyxel/ax7501-b1_firmware | β€ 5.17\(abpc.6.1\)c0 | β |
| zyxel/pe3301-00_firmware | β€ 5.63\(acmt.1.1\)c0 | β |
| zyxel/pe5301-01_firmware | β€ 5.63\(acoj.1.1\)c0 | β |
| zyxel/pm3100-t0_firmware | β€ 5.42\(acbf.3\)c0 | β |
| zyxel/pm5100-t0_firmware | β€ 5.42\(acbf.3\)c0 | β |
| zyxel/pm7500-00_firmware | β€ 5.61\(ackk.1\)c0 | β |
| zyxel/pm7300-t0_firmware | β€ 5.42\(abyy.3\)c0 | β |
| zyxel/px3321-t1_firmware | β€ 5.44\(acjb.1.3\)c0 | β |
| zyxel/px3321-t1_firmware | β€ 5.44\(achk.1\)c0 | β |
| zyxel/px5301-t0_firmware | β€ 5.44\(ackb.0.4\)c0 | β |
| zyxel/we3300-00_firmware | β€ 5.70\(acka.0\)c0 | β |
| zyxel/wx3100-t0_firmware | β€ 5.50\(abvl.4.7\)c0 | β |
| zyxel/wx3401-b0_firmware | β€ 5.17\(abve.2.8\)c0 | β |
| zyxel/wx3401-b1_firmware | β€ 5.17\(abve.2.8\)c0 | β |
| zyxel/wx5600-t0_firmware | β€ 5.70\(aceb.4.1\)c0 | β |
| zyxel/wx5610-b0_firmware | β€ 5.18\(acgj.0.3\)c0 | β |