PT-2025-4087 · Zyxel · Zyxel Vmg4325-B10A

Publicado 2025-02-04 · Atualizado 2025-12-15 · CVE-2025-0890

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0 20170615

Description The issue concerns insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A, which could allow an attacker to log in to the management interface if administrators fail to change the default credentials. This includes improper authentication via Telnet and OS Command Injections.

Recommendations For Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0 20170615, consider changing the default Telnet credentials to prevent unauthorized access. As a temporary workaround, restrict access to the Telnet function until the issue is resolved.

Correção

Using Hardcoded Credentials

Insufficiently Protected Credentials

Improper Authentication

Enumeração de Fraquezas

CWE-798

CWE-522

CWE-287

Identificadores relacionados

BDU:2025-01344

CVE-2025-0890

Produtos afetados

Zyxel Vmg4325-B10A

Referências · 20

• https://t.me/pentestingnews/56166 · Publicação no Telegram
• https://t.me/cveNotify/145845 · Publicação no Telegram
• https://twitter.com/securityRSS/status/1887193774587076828 · Publicação no Twitter
• https://t.me/cvedetector/17185 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1886720135072829489 · Publicação no Twitter
• https://twitter.com/Dinosn/status/1887344501485674950 · Publicação no Twitter
• https://twitter.com/ET_Labs/status/1890518698504438098 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/1887322507235238050 · Publicação no Twitter
• https://t.me/netlas/333 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1886724273508630792 · Publicação no Twitter
• https://twitter.com/Komodosec/status/1898403978876162140 · Publicação no Twitter
• https://twitter.com/fridaysecurity/status/1887324755767779405 · Publicação no Twitter
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 · Aviso do Fabricante
• https://t.me/secharvester/18176 · Publicação no Telegram
• https://twitter.com/BursaMatus/status/1886731663238918513 · Publicação no Twitter