Actively exploited in the wild

Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel - DSL CPE Devices · Listed in the CISA KEV since 2025-02-11. This indicates confirmed attacks in production environments.

Required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

CVE-2024-40890

HighCVSS 8.8KEV

Published: 04/02/2025(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

Risk Assessment

The risk includes potential full compromise of the device by an authenticated attacker, which could lead to network security breach.

Recommendation

Since the product is no longer supported, it is recommended to decommission these devices and replace them with newer models.

Other vulnerabilities in Zyxel VMG4325-B10A

CVE-2024-40891HighActively exploited
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.

Original NVD description (English source)

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.