Zyxel Legacy DSL CPE Router Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242167);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/16");

  script_cve_id("CVE-2024-40890", "CVE-2024-40891", "CVE-2025-0890");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/03/04");

  script_name(english:"Zyxel Legacy DSL CPE Router Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The router is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its model number, the remote Zyxel router is affected by multiple vulnerabilities, as follows:

  - A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel
    VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute
    operating system (OS) commands on an affected device by sending a crafted HTTP POST request. (CVE-2024-40890)

  - A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE
    Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to
    execute operating system (OS) commands on an affected device via Telnet. (CVE-2024-40891)

  - Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware
    version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the
    administrators have the option to change the default credentials but fail to do so. (CVE-2025-0890)

Note that Nessus has not tested for these issues, but has instead relied on the router's self-reported model number.");
  # https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bd950e9e");
  script_set_attribute(attribute:"solution", value:
"See vendor advisory");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-0890");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/h:zyxel");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zyxel_router_detect_getbasicinfo.nbin");
  script_require_keys("www/zyxel_router");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include('http.inc');
include('install_func.inc');
include('lists.inc');

var app = 'Zyxel Router';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:80);

var install = get_single_install(app_name:app, port:port, exit_if_unknown_ver:false);

var models = [
  'VMG1312-B10A',
  'VMG1312-B10B',
  'VMG1312-B10E',
  'VMG3312-B10A',
  'VMG3313-B10A',
  'VMG3926-B10B',
  'VMG4325-B10A',
  'VMG4380-B10A',
  'VMG8324-B10A',
  'VMG8924-B10A',
  'SBG3300',
  'SBG3500'
];

if (!collib::contains(models, install.model))
{
  audit(AUDIT_HOST_NOT, 'an affected Zyxel router model');
}

var report =
  '\n  Solution : See vendor advisory' +
  '\n';

security_report_v4(port:port, severity:SECURITY_HOLE, extra:report);