PT-2025-47237 · Zyxel · Zyxel Dx3300-T0

Published 2025-11-18 · Updated 2025-12-15 · CVE-2025-8693

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel DX3300-T0 firmware versions prior to 5.50(ABVY.6.3)C0

Description A post-authentication command injection issue exists in the priv parameter. Successful exploitation allows an authenticated attacker to execute operating system (OS) commands on an affected device. The vulnerability is present in the Zyxel DX3300-T0 firmware.

Recommendations Update Zyxel DX3300-T0 firmware to version 5.50(ABVY.6.3)C0 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-15911

CVE-2025-8693

Affected Products

Zyxel Dx3300-T0

References · 13

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-uncontrolled-resource-consumption-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-11-18-2025 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15911 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8693 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8693 · Security Note
• https://t.me/CVEtracker/37571 · Telegram Post
• https://twitter.com/gothburz/status/1990933443128025514 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990713215269900466 · Twitter Post
• https://twitter.com/autumn_good_35/status/1990813997289881620 · Twitter Post
• https://twitter.com/cracbot/status/1992548730705416581 · Twitter Post
• https://twitter.com/CveFindCom/status/1990610926781804809 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1990662223119659249 · Twitter Post
• https://twitter.com/RedPacketSec/status/1990806221188730927 · Twitter Post
• https://t.me/cveNotify/145762 · Telegram Post