Login Request a demo
Critical severity · published Feb 4, 2025
CVE-2025-0890
**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an…
9.8
CVSS
14.4%
EPSS
No
On KEV
Description
**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)14.4% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Sbg3300-n000 Firmware · Zyxel
All versions, or not specified · source: NVD
SF
Sbg3300-nb00 Firmware · Zyxel
All versions, or not specified · source: NVD
SF
Sbg3500-n000 Firmware · Zyxel
All versions, or not specified · source: NVD
SF
Sbg3500-nb00 Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg1312-b10a Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg1312-b10b Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg1312-b10e Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg3312-b10a Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg3313-b10a Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg3926-b10b Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg4325-b10a Firmware · Zyxel
All versions, or not specified · source: NVD
VF
Vmg4380-b10a Firmware · Zyxel
All versions, or not specified · source: NVD
Affected product
SF
Sbg3300-n000 Firmware
Zyxel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0890
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0890
Vendor Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
More from Sbg3300-n000 Firmware
8.8
CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability
8.8
CVE-2024-40890
Zyxel DSL CPE OS Command Injection Vulnerability
5.9
CVE-2015-7256
ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A,…