high8.8Known exploited
CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-02-11. Federal due date: 2025-03-04.
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Impact
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Vmg1312-B10a Firmware | All versions |
| Zyxel | Vmg1312-B10b Firmware | All versions |
| Zyxel | Vmg1312-B10e Firmware | All versions |
| Zyxel | Vmg3312-B10a Firmware | All versions |
| Zyxel | Vmg3313-B10a Firmware | All versions |
| Zyxel | Vmg3926-B10b Firmware | All versions |
| Zyxel | Vmg4325-B10a Firmware | All versions |
| Zyxel | Vmg4380-B10a Firmware | All versions |
| Zyxel | Vmg8324-B10a Firmware | All versions |
| Zyxel | Vmg8924-B10a Firmware | All versions |
| Zyxel | Sbg3300-N000 Firmware | All versions |
| Zyxel | Sbg3300-Nb00 Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891