A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 24, 2026 · NIST NVD

   Detected

   A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device.

2. Jun 17, 2026 · NIST NVD

   Updated

   A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device.

Affected

• cpe zyxel/ax7501-b1 firmwareversion unspecified
• cpe zyxel/ex5601-t1 firmwareversion unspecified
• cpe zyxel/ex7501-b0 firmwareversion unspecified
• cpe zyxel/ex7710-b0 firmwareversion unspecified
• cpe zyxel/gm4100-b0 firmwareversion unspecified
• cpe zyxel/pe3301-00 firmwareversion unspecified
• cpe zyxel/pe5301-01 firmwareversion unspecified
• cpe zyxel/pm3100-t0 firmwareversion unspecified
• cpe zyxel/pm7500-00 firmwareversion unspecified
• cpe zyxel/vmg3625-t50b firmwareversion unspecified
• cpe zyxel/vmg4005-b50a firmwareversion unspecified
• cpe zyxel/vmg4005-b60a firmwareversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2025-13943

  A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device.

  nvd.nist.gov

References

• Vendor Advisory · zyxel.com