CVE-2025-0890

⛔ critical

Summary

**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.

CVSS Score

9.8

Critical

EPSS Score

1.2

Exploit Probability

Published Date

2025-02-04

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.6% of all 365,968 vulnerabilities in our database.

#34,458

Top 10% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Feb 4, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2025-12-15

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-287 CWE-522

📦 Affected Products 14

Vendor	Product	Status	Affected Versions
zyxel	vmg1312-b10a_firmware	Affected	v-
zyxel	vmg4380-b10a_firmware	Affected	v-
zyxel	vmg8324-b10a_firmware	Affected	v-
zyxel	vmg8924-b10a_firmware	Affected	v-
zyxel	sbg3300-n000_firmware	Affected	v-
zyxel	sbg3300-nb00_firmware	Affected	v-
zyxel	sbg3500-n000_firmware	Affected	v-
zyxel	vmg1312-b10b_firmware	Affected	v-
zyxel	vmg1312-b10e_firmware	Affected	v-
zyxel	vmg3312-b10a_firmware	Affected	v-
zyxel	vmg3313-b10a_firmware	Affected	v-
zyxel	vmg3926-b10b_firmware	Affected	v-
zyxel	vmg4325-b10a_firmware	Affected	v-
zyxel	sbg3500-nb00_firmware	Affected	v-

🔗 References 1

https://www.zyxel.com/global/en/support/security-adv...

Vendor Advisory

🔗 Related CVEs 3

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2024-40890	⚠️ high	8.8	13.0	UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the CGI program of the legacy DSL...	2025-02-04
CVE-2024-40891	⚠️ high	8.8	39.3	UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the management commands of the le...	2025-02-04
CVE-2015-7256	🔶 medium	5.9	0.1	ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A,...	2017-09-28

These CVEs affect the same products