CVE-2026-0711

—

CVSS 3.1

6.8 medium

EPSS

<1%p56

Published

Apr 28, 2026 (Apr 28, 2026)

Modified

Jul 25, 2026

Description

A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device.

Vendors: zyxel
Products: nr5307 firmware, nebula fwa515 firmware, dx3300-t0 firmware, dx3300-t1 firmware, dx3301-t0 firmware, dx5401-b0 firmware, dx5401-b1 firmware, ee3301-00 firmware, ee5301-00 firmware, ee6510-10 firmware, emg3525-t50b firmware, emg5523-t50b firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.