ZeroDay Findings
Sign inSign up

Findings

CVE-2024-40890

Zyxel DSL CPE OS Command Injection Vulnerability

Published Feb 4, 2025 · updated Jun 17, 2026 · zyxel vmg1312-b10a firmware

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 4, 2025 · Catalog

    Detected

    **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

  2. Feb 11, 2025 · CISA KEV

    Known exploited

    The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

  3. Mar 4, 2025 · CISA KEV

    Remediation due

    The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

Required action

The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

CISA due date Mar 4, 2025

Affected

  • cpe zyxel/sbg3300-n000 firmwareversion unspecified
  • cpe zyxel/sbg3300-nb00 firmwareversion unspecified
  • cpe zyxel/vmg1312-b10a firmwareversion unspecified
  • cpe zyxel/vmg1312-b10b firmwareversion unspecified
  • cpe zyxel/vmg1312-b10e firmwareversion unspecified
  • cpe zyxel/vmg3312-b10a firmwareversion unspecified
  • cpe zyxel/vmg3313-b10a firmwareversion unspecified
  • cpe zyxel/vmg3926-b10b firmwareversion unspecified
  • cpe zyxel/vmg4325-b10a firmwareversion unspecified
  • cpe zyxel/vmg4380-b10a firmwareversion unspecified
  • cpe zyxel/vmg8324-b10a firmwareversion unspecified
  • cpe zyxel/vmg8924-b10a firmwareversion unspecified
  • vendor Zyxel DSL CPE Devicesversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2024-40890

    Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2024-40890

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-40890

    30-day exploitation probability 20.7%

    first.org
  • NIST NVDVulnerability recordCVE-2024-40890

    **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected

    nvd.nist.gov

References