A vulnerable parameter in the DHCP configuration file, named DomainName, allows an attacker who has already authenticated with administrative privileges to inject arbitrary OS commands. The flaw is a classic command injection, identified as CWE‑78, and could lead to uncontrolled execution of malicious system commands, compromising the integrity and confidentiality of the device.

Zyxel DX3301-T0 and EX3301-T0 routers with firmware versions up to and including 5.50(ABVY.7.1)C0. The affected devices are 4G/LTE and 5G NR CPEs, DSL/ethernet/OPT fiber ONTs, and wireless extenders used by organizations.

The CVSS score of 7.2 indicates a high severity and the lack of an EPSS score means known exploitation data is not currently measurable; however the vulnerability is not yet listed in the CISA KEV catalog. An attacker would need administrative credentials, which are typically limited, but once obtained could execute arbitrary commands on the device. The attack vector is local network or remote if the device is reachable from outside the private network, and the scope is limited to the target device.