CVE-2025-0890

Katalog CVE

CVSS 9.8 · Critical EPSS 13,6%

Kerentanan Improper Authentication pada zyxel vmg4325-b10a firmware, zyxel sbg3500-n000 firmware +12 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut zyxel.com.tw.

Deskripsi (NVD)

**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.

Rincian

Terbit di NVD

4 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber zyxel.com.tw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

13,6% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-... advisory vendor