CVE-2025-8693

HighCVSS 8.8

Published: 18/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.05%

64th percentile - higher than 64% of all known CVEs

Summary

A post-authentication command injection vulnerability exists in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier. An authenticated attacker could execute operating system commands on an affected device.

Risk Assessment

An authenticated attacker can exploit the vulnerability to execute arbitrary OS commands, potentially leading to full device compromise. This may allow network configuration changes or further attacks.

Recommendation

Update Zyxel DX3300-T0 firmware to a version later than 5.50(ABVY.6.3)C0 that includes the fix. Protect administrative access with strong passwords and restrict it to trusted networks.

Other vulnerabilities in Zyxel DX3300-T0

CVE-2026-0711Medium
A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 allows an authenticated, adjacent attacker with administrator privileges to execute OS commands on an affected device.

Original NVD description (English source)

A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute operating system (OS) commands on an affected device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS