← CVE Radar
CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
8.8 HIGHEPSS 22.88%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1Zyxel (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Mar 4, 2025
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Details
- CVE ID
- CVE-2024-40891
- Status
- Analyzed
- Assigner (CNA)
- Zyxel
- Published
- Feb 4, 2025
- Last modified
- 2026-06-17 07:46 UTC
- Weaknesses
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
As published by the CNA in the CVE record.
ZyxelVMG4325-B10A firmware1 version range
- <= 1.00(AAFR.4)C0_20170615