⚠ Actively exploited
Added to CISA KEV on 2025-02-11. Federal agencies required to patch by 2025-03-04. Required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable..

CVE-2024-40890

Severity
8.8HIGH
EPSS
45.9%
top 2.37%
CISA KEV
KEV
Added 2025-02-11
Due 2025-03-04
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 4
KEV addedFeb 11
Latest updateFeb 14
KEV dueMar 4
CISA Required Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

Description

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

CVEListV5zyxel/vmg4325-b10a_firmware1.00(AAFR.4)C0_20170615

🔴Vulnerability Details

3
CVEList
CVE-2024-40890: **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmwa2025-02-04
GHSA
GHSA-r9jg-gp7p-hp34: **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmwa2025-02-04
VulnCheck
Zyxel DSL CPE OS Command Injection Vulnerability2024

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS Zyxel DSL CPE Authenticated HTTP Command Injection (CVE-2024-40890)2025-02-14

📋Vendor Advisories

1
CISA
Zyxel DSL CPE OS Command Injection Vulnerability2025-02-11
CVE-2024-40890 (HIGH CVSS 8.8) | **UNSUPPORTED WHEN ASSIGNED** A pos | cvebase.io