PT-2025-4087 · Zyxel · Zyxel Vmg4325-B10A

Published 2025-02-04 · Updated 2025-12-15 · CVE-2025-0890

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0 20170615

Description The issue concerns insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A, which could allow an attacker to log in to the management interface if administrators fail to change the default credentials. This includes improper authentication via Telnet and OS Command Injections.

Recommendations For Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0 20170615, consider changing the default Telnet credentials to prevent unauthorized access. As a temporary workaround, restrict access to the Telnet function until the issue is resolved.

Fix

Using Hardcoded Credentials

Insufficiently Protected Credentials

Improper Authentication

Weakness Enumeration

CWE-798

CWE-522

CWE-287

Related Identifiers

BDU:2025-01344

CVE-2025-0890

Affected Products

Zyxel Vmg4325-B10A

References · 20

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01344 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0890 · Security Note
• https://t.me/pentestingnews/56166 · Telegram Post
• https://t.me/cveNotify/145845 · Telegram Post
• https://twitter.com/securityRSS/status/1887193774587076828 · Twitter Post
• https://t.me/cvedetector/17185 · Telegram Post
• https://twitter.com/CVEnew/status/1886720135072829489 · Twitter Post
• https://twitter.com/Dinosn/status/1887344501485674950 · Twitter Post
• https://twitter.com/ET_Labs/status/1890518698504438098 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1887322507235238050 · Twitter Post
• https://t.me/netlas/333 · Telegram Post
• https://twitter.com/CveFindCom/status/1886724273508630792 · Twitter Post
• https://twitter.com/Komodosec/status/1898403978876162140 · Twitter Post
• https://twitter.com/fridaysecurity/status/1887324755767779405 · Twitter Post