CVE-2025-0890CWE-287

**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version…

Critical · published February 4, 2025

CVSS v3.1
9.8
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

🚨 Insecure default credentials are a ticking time bomb! If you’re using the Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615, you might be inviting trouble right through your front door. 🔥 Think of it like leaving your front door wide open with a ‘welcome’ mat that also has the keys to your house hidden underneath. If the admin hasn’t changed those default credentials, it’s like giving anyone the green light to walk right in! An attacker could effortlessly log in to the management interface, taking control of your device and potentially compromising your entire network. It's absolutely devastating — they could change settings, siphon off data, or even launch attacks on other devices you thought were safe! This is not just a minor oversight; it’s a serious security risk.

Put simply

Think of it like leaving your front door wide open with a ‘welcome’ mat that also has the keys to your house hidden underneath. If the admin hasn’t changed those default credentials, it’s like giving anyone the green light to walk right in! This vulnerability arises from the use of insecure default credentials in the Telnet function of the vulnerable firmware. If administrators neglect to change these credentials, attackers can gain unauthorized access to critical management interfaces.

What to do

An attacker could effortlessly log in to the management interface, taking control of your device and potentially compromising your entire network. It's absolutely devastating — they could change settings, siphon off data, or even launch attacks on other devices you thought were safe! This is not just a minor oversight; it’s a serious security risk. To secure your network, immediately change the default credentials if you haven't done so already. Additionally, it's wise to update to the latest firmware version if available, and consider disabling Telnet in favor of more secure protocols like SSH. Don’t wait - act now! You've got this! By taking these steps, you’ll not only enhance your security but also earn your superhero cape! 🦸

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.13648 · 96.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-02-04T10:06Z
EPSS history
Timeline
  • 04 FEB 10:06Z
    **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version…
    cvelistv5