All vulnerabilities
CVE-2024-40890

Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel DSL CPE DevicesNetwork & edge
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 11 Feb 2025CISA KEV
Exploit odds (EPSS)20.7%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline4 Mar 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionThe impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 4 Feb 2025, 09:55 UTCPublishedCVE List
  2. 11 Feb 2025Added to CISA KEVCISA KEV

Description

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.

Text from CVE List

Affected versions 1

  • VMG4325-B10A firmwareaffected: <= 1.00(AAFR.4)C0_20170615CVE List

References 4