Dm4200 B0 Firmware
Monthly
A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device. [CVSS 8.8 HIGH]
A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Slowloris-style denial of service in Zyxel DX3301-T0 firmware 5.50(ABVY.6.3)C0 and earlier, with the vendor advisory covering a broader family of Zyxel 4G/5G NR CPE, DSL/Ethernet CPE, fiber ONT, security router and wireless extender models, lets unauthenticated remote attackers tie up the embedded HTTP web-management service by holding many partial connections open. The result is temporary unavailability or degradation of the web GUI only - data-plane networking services keep running - so impact is availability-limited rather than a full device outage. No public exploit identified at time of analysis, and EPSS is only 0.08% (24th percentile); the 7.5 base score reflects network reachability, while our assessed vector (A:L) captures the temporary, management-plane-only disruption.
A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device. [CVSS 8.8 HIGH]
A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Slowloris-style denial of service in Zyxel DX3301-T0 firmware 5.50(ABVY.6.3)C0 and earlier, with the vendor advisory covering a broader family of Zyxel 4G/5G NR CPE, DSL/Ethernet CPE, fiber ONT, security router and wireless extender models, lets unauthenticated remote attackers tie up the embedded HTTP web-management service by holding many partial connections open. The result is temporary unavailability or degradation of the web GUI only - data-plane networking services keep running - so impact is availability-limited rather than a full device outage. No public exploit identified at time of analysis, and EPSS is only 0.08% (24th percentile); the 7.5 base score reflects network reachability, while our assessed vector (A:L) captures the temporary, management-plane-only disruption.