CVE-2025-8693 Command injection in DX3300-T0 firmware

What is CVE-2025-8693?

CVE-2025-8693 is a high-severity command injection vulnerability in Zyxel DX3300-T0 firmware, published on 18 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute operating system (OS) commands on an affected device.

Weakness: CWE-78

Which versions are affected by CVE-2025-8693?

It affects 54 products.

Products include Zyxel Ax7501-B0 Firmware, Zyxel Ax7501-B1 Firmware, Zyxel Dm4200-B0 Firmware, Zyxel Dx3300-T0 Firmware, Zyxel Dx3300-T1 Firmware, Zyxel Dx3301-T0 Firmware and 48 more.

How do I fix CVE-2025-8693?

No fix has been published for CVE-2025-8693 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-8693 being exploited?

There is no known exploitation of CVE-2025-8693 in the wild and no public exploit code.

Other vulnerabilities in Zyxel DX3300-T0 firmware

• CVE-2022-26413 Command injection in VMG3312-T20A firmware High 8.0
• CVE-2024-8748 Memory corruption in VMG8825-T50K firmware High 7.5
• CVE-2024-5412 Memory corruption in VMG8825-T50K firmware High 7.5
• CVE-2024-12009 Command injection in EX5601-T1 firmware High 7.2
• CVE-2024-12010 Command injection in AX7501-B1 firmware High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jvj8-73h8-vqf9.