UNSUPPORTED WHEN ASSIGNED Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware versio…

published 2025-02-04 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-1913

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 14.4%; EPSS 14.4% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 21 mo ago (2025-02-04)

Exploit prediction

14.38% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Zyxel VMG4325-B10A firmware

Classification

Weakness

CWE-287 Improper Authentication
CWE-522 Insufficiently Protected Credentials

References

zyxel.com /global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-cred
vendor-advisory

Sources

CVE List CVE-2025-0890
NVD CVE-2025-0890

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary