stevejiang0509/ex3301-t0-root-ssh-research

What this is

This repo documents an owner-authorized investigation of a Zyxel EX3301-T0 router. The device started on Hyperoptic V5.50(ABVY.4.1)Y1, was upgraded to official Zyxel V5.50(ABVY.7.2)C0, and was then used to verify an authenticated LogServer-to-syslog-ng configuration injection. The work ties the tested build to CVE-2026-6952, which Zyxel describes as a post-authentication command injection in the syslog LogServer field (advisory).

The mechanism is not an SSH or Dropbear flaw. An authenticated web administrator sends a LogServer value that breaks out of a syslog-ng destination string and adds a program() source with a log route; that runs as root. The project then changed the runtime admin UID/GID and shell, so a fresh SSH session returned uid=0. The full call chain and live observations are in technical analysis.

Quick start

Reading the docs is the main way to use this project. Start with the chronology for initial access through root verification, then the technical analysis for the injection path, and the evidence and limits for the sanitized evidence ledger. If you want to check the string-expansion logic, run the local demo with Node.js 20 or newer; there are no package dependencies:

npm test
npm run demo

The test and demo only expand the observed syslog-ng format string in local memory. They do not log in, open network connections, write router settings, or prove any other firmware is vulnerable.

Constraints and scope

The live root result covers one EX3301-T0 on the C0 image and was verified for the current boot only; no reboot-persistent root access was demonstrated. Zyxel lists 5.50(ABVY.8)C0 and earlier as affected, with 5.50(ABVY.8.1)C0 as the patch, and its model table covers 42 models across DSL/Ethernet CPE, fiber ONTs, and wireless extenders. The companion model-scope repository keeps the wider vendor table separate from this single-device proof. ISP-customized models are excluded from Zyxel's table, and the earlier Hyperoptic Y1 build was not separately tested for this issue. Zyxel directs ISP customers to their provider for the appropriate firmware, so the patch listing is not a local validation that 8.1C0 is safe on a customized unit.

The firmware-check section is narrow too: the exact zycli modelcheck off and fwidcheck off commands are runtime checks, and their state after the C0 reboot was not established. They are not a generic unsigned-image or RSA-signature bypass; see firmware check commands for the retained readback. The repository is sanitized and contains no passwords, session tokens, keys, serial number, MAC address, configuration backup, or firmware image. Licensing is MIT.

HotRepo's take

The repository has no recorded GitHub daily ranking. Its star samples grew from about 101 on 12 November 2026 to 242 by 14 November, with the new-project snapshot reporting 77 stars gained in the roughly 24-hour window ending 14 November 2026. That is real attention for a one-device router case study, but the evidence is deliberately scoped: one hardware unit, one C0 build, current-boot verification, and an offline string demo rather than an exploit toolkit. Readers should treat it as a documented case study and a pointer to Zyxel's advisory scope, not as a universal root method for the listed models.