CVE-2025-0890

Firmware in Zyxel VMG4325-B10A devices (version 1.00(AAFR.4)C0_20170615) and related models contains factory-set credentials for the Telnet service. Administrators have the technical capability to change these credentials, however, if they do not, an attacker can log into the management interface using publicly known default authentication credentials. The vulnerability is classified as CWE-287 (improper authentication) and CWE-522 (insufficiently protected credentials).

An attacker gains full access to the device's management interface via Telnet, which may lead to device takeover, modification of its configuration, breach of confidentiality and integrity of transmitted data, and potential use of the device as an entry point to the internal network.

The manufacturer has designated these devices as independently supported (UNSUPPORTED WHEN ASSIGNED) — official patches may not be available. Default authentication credentials for Telnet functionality must be changed immediately, and ideally the Telnet service should be completely disabled and replaced with a more secure protocol (e.g., SSH). It is recommended to consider replacing devices with supported models. Detailed recommendations from the manufacturer are available in the official Zyxel security advisory from 2025-02-04.

Zyxel VMG4325-B10A firmware 1.00(AAFR.4)C0_20170615, Zyxel SBG3500-N000, and Zyxel VMG1312-B10A — devices designated as legacy (independently supported at the time of CVE assignment), specific firmware versions indicated in manufacturer references