{"id":"CVE-2025-0890","aliases":["EUVD-2025-1913","GHSA-q2vf-jq2x-689c"],"status":"published","title":"**UNSUPPORTED WHEN ASSIGNED**\nInsecure default credentials for the Telnet function in the legacy...","description":"**UNSUPPORTED WHEN ASSIGNED**\nInsecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.14379,"percentile":0.96642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287","CWE-522"],"published":"2025-02-04T10:06:56Z","modified":"2026-06-17T08:27:19Z","exploits":[{"source":"pocgithub","id":"Danyw24/zyxel-p870hn-hardware-hacking","title":"Danyw24/zyxel-p870hn-hardware-hacking","date":"2026-08-13","url":"https://github.com/Danyw24/zyxel-p870hn-hardware-hacking"},{"source":"pocgithub","id":"krevetkqqq/CVE-2025-0890","title":"krevetkqqq/CVE-2025-0890","date":"2026-10-30","url":"https://github.com/krevetkqqq/CVE-2025-0890"}],"products":[{"vendor":"zyxel","product":"sbg3300-n000_firmware"},{"vendor":"zyxel","product":"sbg3300-nb00_firmware"},{"vendor":"zyxel","product":"sbg3500-n000_firmware"},{"vendor":"zyxel","product":"sbg3500-nb00_firmware"},{"vendor":"zyxel","product":"vmg1312-b10a_firmware"},{"vendor":"zyxel","product":"vmg1312-b10b_firmware"},{"vendor":"zyxel","product":"vmg1312-b10e_firmware"},{"vendor":"zyxel","product":"vmg3312-b10a_firmware"},{"vendor":"zyxel","product":"vmg3313-b10a_firmware"},{"vendor":"zyxel","product":"vmg3926-b10b_firmware"},{"vendor":"zyxel","product":"vmg4325-b10a firmware"},{"vendor":"zyxel","product":"vmg4325-b10a_firmware"},{"vendor":"zyxel","product":"vmg4380-b10a_firmware"},{"vendor":"zyxel","product":"vmg8324-b10a_firmware"},{"vendor":"zyxel","product":"vmg8924-b10a_firmware"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0890"},{"url":"https://github.com/advisories/GHSA-q2vf-jq2x-689c"}],"sources":{"cve":[{"id":"CVE-2025-0890","description":"**UNSUPPORTED WHEN ASSIGNED**\nInsecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.","status":"published","published":"2025-02-04T10:06:56.163Z","modified":"2025-02-12T20:51:26.709Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-1913","description":"**UNSUPPORTED WHEN ASSIGNED**\nInsecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.","status":"published","published":"2025-02-04T10:06:56Z","modified":"2025-02-12T20:51:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:03:55.950052Z"}],"ghsa":[{"id":"GHSA-q2vf-jq2x-689c","title":"**UNSUPPORTED WHEN ASSIGNED**\nInsecure default credentials for the Telnet function in the legacy...","description":"**UNSUPPORTED WHEN ASSIGNED**\nInsecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.","status":"published","published":"2025-02-04T12:30:59Z","modified":"2025-12-15T21:31:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287","CWE-522"],"updated_at":"2026-11-02T15:05:12.969095Z"}],"nvd":[{"id":"CVE-2025-0890","description":"**UNSUPPORTED WHEN ASSIGNED**\nInsecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.","status":"published","published":"2025-02-04T11:15:08.88Z","modified":"2026-06-17T08:27:19.547Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-287","CWE-522"],"updated_at":"2026-11-02T14:10:50.916773Z"}]}}