⚠ Actively exploited
Added to CISA KEV on 2025-02-11. Federal agencies required to patch by 2025-03-04. Required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable..
CVE-2024-40890
Severity
8.8HIGH
EPSS
45.9%
top 2.37%
CISA KEV
KEV
Added 2025-02-11
Due 2025-03-04
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 4
KEV addedFeb 11
Latest updateFeb 14
KEV dueMar 4
CISA Required Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Description
**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages1 packages
🔴Vulnerability Details
3CVEList▶
CVE-2024-40890: **UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmwa↗2025-02-04
GHSA▶
GHSA-r9jg-gp7p-hp34: **UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmwa↗2025-02-04
🔍Detection Rules
1Suricata
▶