Detections
Analytics
Zyxel Legacy DSL CPE Router Multiple Vulnerabilities
critical Nessus Plugin ID 242167
Language:
Synopsis
The router is affected by multiple vulnerabilities.Description
According to its model number, the remote Zyxel router is affected by multiple vulnerabilities, as follows:- A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request. (CVE-2024-40890)
- A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet. (CVE-2024-40891)
- Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so. (CVE-2025-0890)
Note that Nessus has not tested for these issues, but has instead relied on the router's self-reported model number.
Solution
See vendor advisorySee Also
Plugin Details
Severity: Critical
ID: 242167
File Name: zyxel_router_legacy_dsl_cpe.nasl
Version: 1.1
Type: remote
Family: Misc.
Published: 7/16/2025
Updated: 7/16/2025
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-0890
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: x-cpe:/h:zyxel
Required KB Items: www/zyxel_router
Vulnerability Publication Date: 7/31/2024
CISA Known Exploited Vulnerability Due Dates: 3/4/2025