CVE-2004-0680

CVE-2004-0680 describes a critical vulnerability in the Zoom X3 ADSL modem (model 5560) where a terminal on port 254 remains accessible with the default HTML management password, even if the HTTP interface password has been changed. This allows remote, unauthenticated attackers to gain complete control over the device. With a CVSS score of 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), the vulnerability is easily exploitable over the network with no authentication, leading to full compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness among security researchers.