CVE-2025-0890: Zyxel SBG3300-n000 Firmware

Critical severity, CVSS 9.8. EPSS: 13.6% chance of exploitation in the next 30 days.

**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.

Affected products

• Zyxel SBG3300-n000 Firmware: affected versions not specified
• Zyxel SBG3300-NB00 Firmware: affected versions not specified
• Zyxel SBG3500-n000 Firmware: affected versions not specified
• Zyxel SBG3500-NB00 Firmware: affected versions not specified
• Zyxel VMG1312-b10a Firmware: affected versions not specified
• Zyxel VMG1312-b10b Firmware: affected versions not specified
• Zyxel VMG1312-b10e Firmware: affected versions not specified
• Zyxel VMG3312-b10a Firmware: affected versions not specified
• Zyxel VMG3313-b10a Firmware: affected versions not specified
• Zyxel VMG3926-b10b Firmware: affected versions not specified
• Zyxel VMG4325-b10a Firmware: affected versions not specified
• Zyxel VMG4380-b10a Firmware: affected versions not specified
• Zyxel VMG8324-b10a Firmware: affected versions not specified
• Zyxel VMG8924-b10a Firmware: affected versions not specified

Published 2025-02-04. Last modified 2026-06-17.