CVE-2025-0890 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Default credentials are insecure. 📉 **Consequences**: Full system compromise. Attackers gain unauthorized access easily. Critical risk to device integrity.

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-287 (Improper Authentication). 🔍 **Flaw**: Weak or default login credentials shipped with the firmware. No strong password enforcement.

Q: Who is affected? (Versions/Components)

📦 **Affected**: Zyxel VMG4325-B10A Modem. 📜 **Version**: 1.00(AAFR.4)C0_20170615. ⚠️ **Vendor**: Zyxel (China). Only specific legacy firmware is vulnerable.

Q: What can hackers do? (Privileges/Data)

💻 **Privileges**: Full administrative control. 📂 **Data**: Complete read/write access. 🌐 **Impact**: High (C:H/I:H/A:H). Hackers can execute commands, steal data, or brick the device.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Auth**: None required (PR:N). 🌍 **Access**: Network remote (AV:N). 🚫 **UI**: No interaction needed (UI:N). 📉 **Threshold**: LOW. Extremely easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exp**: No PoC listed in data. 🕵️ **Wild Exp**: Unconfirmed. However, default cred attacks are trivial. High risk of manual exploitation by attackers.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for Zyxel VMG4325-B10A. 📋 **Verify**: Check firmware version `1.00(AAFR.4)C0_20170615`. 🧪 **Test**: Attempt login with known default credentials (if safe/legal). Use vulnerability scanners.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Vendor advisory exists. 🔗 **Link**: Zyxel Security Advisory (2025-02-04). ✅ **Status**: Official patch/mitigation guidance available via vendor support.

Q: What if no patch? (Workaround)

🚧 **Workaround**: Change default passwords immediately. 🚫 **Disable**: Remote management if possible. 🔒 **Network**: Isolate device. 📞 **Contact**: Reach out to Zyxel support for firmware updates.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: CRITICAL. 📅 **Urgency**: High. CVSS Score is High (7.5+ implied by H:H:H). ⚡ **Action**: Patch or mitigate NOW. Legacy devices are prime targets.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Default credentials are insecure. 📉 **Consequences**: Full system compromise. Attackers gain unauthorized access easily. Critical risk to device integrity.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-287 (Improper Authentication). 🔍 **Flaw**: Weak or default login credentials shipped with the firmware. No strong password enforcement.

Q3Who is affected? (Versions/Components)

📦 **Affected**: Zyxel VMG4325-B10A Modem. 📜 **Version**: 1.00(AAFR.4)C0_20170615. ⚠️ **Vendor**: Zyxel (China). Only specific legacy firmware is vulnerable.

Q4What can hackers do? (Privileges/Data)

💻 **Privileges**: Full administrative control. 📂 **Data**: Complete read/write access. 🌐 **Impact**: High (C:H/I:H/A:H). Hackers can execute commands, steal data, or brick the device.

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Auth**: None required (PR:N). 🌍 **Access**: Network remote (AV:N). 🚫 **UI**: No interaction needed (UI:N). 📉 **Threshold**: LOW. Extremely easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exp**: No PoC listed in data. 🕵️ **Wild Exp**: Unconfirmed. However, default cred attacks are trivial. High risk of manual exploitation by attackers.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for Zyxel VMG4325-B10A. 📋 **Verify**: Check firmware version `1.00(AAFR.4)C0_20170615`. 🧪 **Test**: Attempt login with known default credentials (if safe/legal). Use vulnerability scanners.

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Vendor advisory exists. 🔗 **Link**: Zyxel Security Advisory (2025-02-04). ✅ **Status**: Official patch/mitigation guidance available via vendor support.

Q9What if no patch? (Workaround)

🚧 **Workaround**: Change default passwords immediately. 🚫 **Disable**: Remote management if possible. 🔒 **Network**: Isolate device. 📞 **Contact**: Reach out to Zyxel support for firmware updates.

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: CRITICAL. 📅 **Urgency**: High. CVSS Score is High (7.5+ implied by H:H:H). ⚡ **Action**: Patch or mitigate NOW. Legacy devices are prime targets.

Continue exploring

Vulnerability detail Full AI analysis (login) Zyxel CWE-287