Zyxel VMG3313-b10a Firmware vulnerabilities

3 CVEs affecting Zyxel VMG3313-b10a Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0890, published 2025-02-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability, published 2025-02-04. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-02-11. EPSS: 21.7% chance of exploitation in the next 30 days. **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could…
CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability, published 2025-02-04. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-02-11. EPSS: 20.7% chance of exploitation in the next 30 days. **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an…
CVE-2025-0890, published 2025-02-04. Critical severity, CVSS 9.8. EPSS: 13.6% chance of exploitation in the next 30 days. **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in…