Actively exploited · Published Feb 4, 2025 · Assigned by Zyxel
CVE-2024-40891
High 8.8 Exploited
In plain English
A high-severity OS command injection in VMG4325-B10A firmware from Zyxel. Attackers are actively exploiting it in the wild (listed by CISA on February 11, 2025). The chance it is exploited in the next 30 days is estimated at 22.9% (higher than 98% of all known vulnerabilities). The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
CISA guidance
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Federal agencies must remediate by Mar 4, 2025.
Official description
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | VMG4325-B10A firmware | <= 1.00(AAFR.4)C0_20170615 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891 government-resource