GCVE - cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Zyxel (`d3fcf896-5708-55f8-8f74-3e19a9d55b89`)
Product	Vmg8924 B10A (`20cc367a-d172-5625-888d-4e366dc1bb06`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-0890`	not_vulnerable	2026-06-08 07:02:25.855025	Details available CRITICAL (9.8) UNSUPPORTED WHEN ASSIGNED Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so. Published: 2025-02-04T10:06:56.163Z Updated: 2025-02-12T20:51:26.709Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-40891`	not_vulnerable	2026-06-08 06:43:53.518794	Details available HIGH (8.8) UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet. Published: 2025-02-04T10:02:48.018Z Updated: 2025-10-21T22:55:30.272Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-40890`	not_vulnerable	2026-06-08 06:43:53.510432	Details available HIGH (8.8) UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request. Published: 2025-02-04T09:55:38.908Z Updated: 2025-10-21T22:55:30.414Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-7256`	not_vulnerable	2026-06-08 05:07:00.241787	Details available ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, VMG8924-B30A, and VSG1435-B101 DSL CPEs; PMG5318-B20A GPONs; SBG3300-N000, SBG3300-NB00, and SBG3500-N000 small business gateways; GS1900-8 and GS1900-24 switches; and C1000Z, Q1000, FR1000Z, and P8702N project models use non-unique X.509 certificates and SSH host keys. Published: 2017-09-27T18:00:00.000Z Updated: 2024-08-06T07:43:45.967Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/566724 http://www.zyxel.com/support/announcement_SSH_private_key_and_certificate_vulnerability.shtml	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.