Evil-DB LogoEvil-DB
← All CVEs

CVE-2025-0890

critical · 9.8

**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.

9.8
CVSS
13.5%
EPSS (exploit prob.)
96th
EPSS percentile
2025-02-04
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287CWE-522

Affected products

VendorProductAffected versions
zyxelvmg4325-b10a_firmwareall versions
zyxelvmg4325-b10aall versions
zyxelsbg3500-n000_firmwareall versions
zyxelsbg3500-n000all versions
zyxelvmg1312-b10a_firmwareall versions
zyxelvmg1312-b10aall versions
zyxelvmg1312-b10b_firmwareall versions
zyxelvmg1312-b10ball versions
zyxelvmg1312-b10e_firmwareall versions
zyxelvmg1312-b10eall versions
zyxelvmg3312-b10a_firmwareall versions
zyxelvmg3312-b10aall versions
zyxelvmg3313-b10a_firmwareall versions
zyxelvmg3313-b10aall versions
zyxelvmg3926-b10b_firmwareall versions
zyxelvmg3926-b10ball versions
zyxelvmg4325-b10a_firmwareall versions
zyxelvmg4325-b10aall versions
zyxelvmg4380-b10a_firmwareall versions
zyxelvmg4380-b10aall versions
zyxelvmg8324-b10a_firmwareall versions
zyxelvmg8324-b10aall versions
zyxelvmg8924-b10a_firmwareall versions
zyxelvmg8924-b10aall versions
zyxelsbg3300-n000_firmwareall versions
zyxelsbg3300-n000all versions
zyxelsbg3300-nb00_firmwareall versions
zyxelsbg3300-nb00all versions
zyxelsbg3500-nb00_firmwareall versions
zyxelsbg3500-nb00all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-0890