This vulnerability (CVE-2026-1460) affects Zyxel DX3301-T0 and EX3301-T0 firmware versions up to 5.50(ABVY.7.1)C0. It involves improper neutralization of special elements in the DomainName parameter within the DHCP configuration file, which can be exploited by an authenticated attacker with administrator privileges to perform OS command injection. The CVSS v3.1 base score is 7.2, reflecting high impact on confidentiality, integrity, and availability. The vulnerability requires network access and administrator-level privileges to exploit. No patch or official remediation level has been published by Zyxel as of the current data.

Successful exploitation allows an authenticated administrator to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could enable attackers to disrupt device operation, access sensitive information, or pivot within the network. However, exploitation requires prior authentication with administrator privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for unauthorized configuration changes. Avoid exposing device management interfaces to untrusted networks.