#VU103597 Incorrect default permissions in ZyXEL Communications Corp. products - CVE-2025-0890


Vulnerability identifier: #VU103597

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0890

CWE-ID: CWE-276

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
VMG1312-B10A
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG1312-B10B
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG1312-B10E
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG3312-B10A
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG3313-B10A
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG3926-B10B
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG4325-B10A
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG4380-B10A
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG8324-B10A
Hardware solutions / Routers & switches, VoIP, GSM, etc
VMG8924-B10A
Hardware solutions / Routers & switches, VoIP, GSM, etc
SBG3300
Hardware solutions / Routers & switches, VoIP, GSM, etc
SBG3500
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: ZyXEL Communications Corp.

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to insecure default credentials for the Telnet function. A remote attacker can log in to the management interface on the target device.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

VMG1312-B10A: All versions

VMG1312-B10B: All versions

VMG1312-B10E: All versions

VMG3312-B10A: All versions

VMG3313-B10A: All versions

VMG3926-B10B: All versions

VMG4325-B10A: All versions

VMG4380-B10A: All versions

VMG8324-B10A: All versions

VMG8924-B10A: All versions

SBG3300: All versions

SBG3500: All versions

External links
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Incorrect default permissions in Zyxel CPE series devices