PT-2025-47237 · Zyxel · Zyxel Dx3300-T0

Published 2025-11-18 · Updated 2025-11-23 · CVE-2025-8693

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel DX3300-T0 firmware versions prior to 5.50(ABVY.6.3)C0

Description A post-authentication command injection issue exists in the

priv

parameter. Successful exploitation allows an authenticated attacker to execute operating system (OS) commands on an affected device. The vulnerability is present in the Zyxel DX3300-T0 firmware.

Recommendations Update Zyxel DX3300-T0 firmware to version 5.50(ABVY.6.3)C0 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-8693

Affected Products

Zyxel Dx3300-T0

References · 10

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-uncontrolled-resource-consumption-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-11-18-2025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8693 · Security Note
• https://twitter.com/RedPacketSec/status/1990806221188730927 · Twitter Post
• https://t.me/CVEtracker/37571 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1990662223119659249 · Twitter Post
• https://twitter.com/cracbot/status/1992548730705416581 · Twitter Post
• https://twitter.com/gothburz/status/1990933443128025514 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990713215269900466 · Twitter Post
• https://twitter.com/autumn_good_35/status/1990813997289881620 · Twitter Post
• https://twitter.com/CveFindCom/status/1990610926781804809 · Twitter Post