GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-40891 (GCVE-0-2024-40891)

Vulnerability from cvelistv5 – Published: 2025-02-04 10:02 – Updated: 2025-10-21 22:55 Unsupported When Assigned
VLAI CISA Previdian
Summary
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: active Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-11 19:02 UTC
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version CPE status
Zyxel VMG4325-B10A firmware Affected: <= 1.00(AAFR.4)C0_20170615
guessed Create a notification for this product.
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 96045151-10b4-4f63-b699-0f0633ea96f8

Vulnerability ID: CVE-2024-40891

Status: Confirmed

Status Updated: 2025-02-11 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2025-02-11
Asserted: 2025-02-11
Scope
Notes: KEV entry: Zyxel DSL CPE OS Command Injection Vulnerability | Affected: Zyxel / DSL CPE Devices | Description: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. | Required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. | Due date: 2025-03-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40891
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-78
Feed CISA Known Exploited Vulnerabilities Catalog
Product DSL CPE Devices
Due Date 2025-03-04
Date Added 2025-02-11
Vendorproject Zyxel
Vulnerabilityname Zyxel DSL CPE OS Command Injection Vulnerability
Knownransomwarecampaignuse Unknown
References
Created: 2026-02-02 13:24 UTC | Updated: 2026-02-06 07:53 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: c0f852b7-e596-44ce-8746-a9f0c149eb5f

Vulnerability ID: CVE-2024-40891

Status: Confirmed

Status Updated: 2025-02-11 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2025-02-11
Asserted: 2025-02-11
Scope
Notes: KEVIntel entry: **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel... | Affected: Zyxel / VMG4325-B10A firmware | CVSS: 8.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel...
Vendor Zyxel
Product VMG4325-B10A firmware
Added Date 2025-02-11T00:00:00.000Z
Cvss Score 8.8
Epss Score None
Cvss Severity HIGH
Epss Percentile None
Used In Malware unknown
Ahead Of Cisa Kev None
Not Yet In Cisa Kev False
References
Created: 2026-06-23 11:14 UTC | Updated: 2026-06-23 11:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40891",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T19:02:48.530465Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-02-11",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:30.272Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-02-11T00:00:00.000Z",
            "value": "CVE-2024-40891 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VMG4325-B10A firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.00(AAFR.4)C0_20170615"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "**UNSUPPORTED WHEN ASSIGNED**\u003cbr\u003eA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version\u0026nbsp;1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands\u0026nbsp;on an affected device via Telnet.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version\u00a01.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands\u00a0on an affected device via Telnet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-04T10:07:26.641Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2024-40891",
    "datePublished": "2025-02-04T10:02:48.018Z",
    "dateReserved": "2024-07-11T17:35:29.595Z",
    "dateUpdated": "2025-10-21T22:55:30.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-40891",
      "cwes": [
        "CWE-78"
      ],
      "dateAdded": "2025-02-11",
      "dueDate": "2025-03-04",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40891",
      "product": "DSL CPE Devices",
      "requiredAction": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.",
      "shortDescription": "Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.",
      "vendorProject": "Zyxel",
      "vulnerabilityName": "Zyxel DSL CPE OS Command Injection Vulnerability"
    },
    "epss": {
      "cve": "CVE-2024-40891",
      "date": "2026-09-19",
      "epss": "0.21536",
      "percentile": "0.97507"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "VMG4325-B10A firmware",
                "vendor": "Zyxel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 1.00(AAFR.4)C0_20170615"
                  }
                ]
              }
            ],
            "source": "security@zyxel.com.tw"
          }
        ],
        "cisaActionDue": "2025-03-04",
        "cisaExploitAdd": "2025-02-11",
        "cisaRequiredAction": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.",
        "cisaVulnerabilityName": "Zyxel DSL CPE OS Command Injection Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E8CC0C61-EB6A-4736-80E3-B69693D4A2B1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg1312-b10a:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7B6C4A31-3B83-444F-B5F8-1397B43B2211",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8EF1C4A6-0305-4759-8DEC-92EB3D2915B1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg1312-b10b:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B193DF7-5EE9-4A78-A01E-753463665627",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2DF4827D-405E-4D21-A17E-A201EC6F79F3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg1312-b10e:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "155187EA-4A46-4850-B983-BCE245D57777",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7AC711D-503A-48F9-A523-193F29B9DB22",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg3312-b10a:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FFD9DF7D-E6E8-4261-8BD7-12A1AE8839BD",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DDEC1767-C8D9-495F-B809-FCDB39DCF98B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg3313-b10a:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "46446AE5-EBC1-4E4C-A30F-C610C3EB0975",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F7120E86-98DC-4824-BF59-02234501EA29",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg3926-b10b:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1DAF061-1975-4A5B-8206-1E9836DBA1B0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B88B7A0D-D194-47D1-9D78-682EDFC52B52",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg4325-b10a:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "135700AF-7EC0-4E94-8552-B6F1038DE4A8",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4808FDF8-4815-4C4F-AFE7-31EADE517B31",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg4380-b10a:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "88BA2BDF-9ACA-4F89-B7B7-FD232A6399CD",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FF0AFA0F-D126-4D1C-89EC-878AB0F5E74C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg8324-b10a:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "53C32749-82A6-42AA-9EBE-11014F161D2F",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "11BEC42C-7815-4EA3-B1E5-66E2443B5032",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "96DC6BBF-15B8-496F-85FE-5373B6CEDC3C",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "852E8F04-4C28-4904-AA4A-ACE4EAD6DC31",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:sbg3300-n000:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "902A735D-2D84-4183-B4B3-FA36AD9F13A5",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B338AE18-ECE4-4B90-A1D5-16F2983464E7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:sbg3300-nb00:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E4658399-1699-4426-ACFF-BDEE20BF1A54",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BC4B86C-ED2F-406D-BCAA-B970BAD248D8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BC4B86C-ED2F-406D-BCAA-B970BAD248D8",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CD0DECE6-7AFC-4E86-9FFE-1215ECF8324D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:sbg3500-nb00:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5185679F-9FBC-4B2E-AE79-1471EB56E46A",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [
          {
            "sourceIdentifier": "security@zyxel.com.tw",
            "tags": [
              "unsupported-when-assigned"
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version\u00a01.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands\u00a0on an affected device via Telnet."
          },
          {
            "lang": "es",
            "value": "**NO SOPORTADO CUANDO SE ASIGN\u00d3** Una vulnerabilidad de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en los comandos de administraci\u00f3n de la versi\u00f3n de firmware 1.00(AAFR.4)C0_20170615 del CPE DSL heredado Zyxel VMG4325-B10A podr\u00eda permitir que un atacante autenticado ejecute comandos del sistema operativo (OS) en un dispositivo afectado a trav\u00e9s de Telnet."
          }
        ],
        "id": "CVE-2024-40891",
        "lastModified": "2026-06-17T07:46:48.213",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security@zyxel.com.tw",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-40891",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T19:02:48.530465Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-04T10:15:08.920",
        "references": [
          {
            "source": "security@zyxel.com.tw",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891"
          }
        ],
        "sourceIdentifier": "security@zyxel.com.tw",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "security@zyxel.com.tw",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T09:52:24+00:00",
      "cve": "CVE-2024-40891",
      "id": "CVE-2024-40891",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-40891",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40891.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-40891",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-11T19:02:48.530465Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2025-02-11",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-11T19:02:56.761Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2025-02-11T00:00:00.000Z",
                "value": "CVE-2024-40891 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "VMG4325-B10A firmware",
              "vendor": "Zyxel",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 1.00(AAFR.4)C0_20170615"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "**UNSUPPORTED WHEN ASSIGNED**\u003cbr\u003eA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version\u0026nbsp;1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands\u0026nbsp;on an affected device via Telnet.\u003cbr\u003e\u003cbr\u003e"
                }
              ],
              "value": "**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version\u00a01.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands\u00a0on an affected device via Telnet."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-02-04T10:07:26.641Z",
            "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
            "shortName": "Zyxel"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "tags": [
            "unsupported-when-assigned"
          ],
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "assignerShortName": "Zyxel",
        "cveId": "CVE-2024-40891",
        "datePublished": "2025-02-04T10:02:48.018Z",
        "dateReserved": "2024-07-11T17:35:29.595Z",
        "dateUpdated": "2025-10-21T22:55:30.272Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.