Actively exploited · Published Feb 4, 2025 · Assigned by Zyxel
CVE-2024-40890
High 8.8 Exploited
In plain English
A high-severity OS command injection in VMG4325-B10A firmware from Zyxel. Attackers are actively exploiting it in the wild (listed by CISA on February 11, 2025). The chance it is exploited in the next 30 days is estimated at 20.7% (higher than 98% of all known vulnerabilities). The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
CISA guidance
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Federal agencies must remediate by Mar 4, 2025.
Official description
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | VMG4325-B10A firmware | <= 1.00(AAFR.4)C0_20170615 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890 government-resource