CVE-2024-40890

Description

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

References

https://www.securityweek.com/zyxel-issues-no-patch-warning-for-exploited-zero-days/

https://www.bleepingcomputer.com/news/security/zyxel-wont-patch-newly-exploited-flaws-in-end-of-life-routers/

https://www.securityweek.com/new-zyxel-zero-day-under-attack-no-patch-available/

https://www.darkreading.com/endpoint-security/unpatched-zyxel-cpe-zero-day-cyberattackers

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-unpatched-flaw-in-zyxel-cpe-devices/

https://thehackernews.com/2025/01/zyxel-cpe-devices-face-active.html

https://securityaffairs.com/173589/hacking/zyxel-cpe-series-devices-cve-2024-40891-exploited.html

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025

https://www.greynoise.io/blog/active-exploitation-of-zero-day-zyxel-cpe-vulnerability-cve-2024-40891

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3