{"id":"CVE-2024-40890","aliases":["EUVD-2024-38809","GHSA-r9jg-gp7p-hp34"],"status":"published","title":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI...","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.20575,"percentile":0.97552,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2025-02-04T09:55:38Z","modified":"2026-06-17T07:46:48Z","kev":{"date_added":"2025-02-11","due_date":"2025-03-04","required_action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-02-11"},{"source":"kev","since":"2025-02-11"}],"products":[{"vendor":"zyxel","product":"dsl cpe devices"},{"vendor":"zyxel","product":"sbg3300-n000_firmware"},{"vendor":"zyxel","product":"sbg3300-nb00_firmware"},{"vendor":"zyxel","product":"sbg3500-n000_firmware"},{"vendor":"zyxel","product":"sbg3500-nb00_firmware"},{"vendor":"zyxel","product":"vmg1312-b10a_firmware"},{"vendor":"zyxel","product":"vmg1312-b10b_firmware"},{"vendor":"zyxel","product":"vmg1312-b10e_firmware"},{"vendor":"zyxel","product":"vmg3312-b10a_firmware"},{"vendor":"zyxel","product":"vmg3313-b10a_firmware"},{"vendor":"zyxel","product":"vmg3926-b10b_firmware"},{"vendor":"zyxel","product":"vmg4325-b10a firmware"},{"vendor":"zyxel","product":"vmg4325-b10a_firmware"},{"vendor":"zyxel","product":"vmg4380-b10a_firmware"},{"vendor":"zyxel","product":"vmg8324-b10a_firmware"},{"vendor":"zyxel","product":"vmg8924-b10a_firmware"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40890"},{"url":"https://github.com/advisories/GHSA-r9jg-gp7p-hp34"}],"sources":{"cve":[{"id":"CVE-2024-40890","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.","status":"published","published":"2025-02-04T09:55:38.908Z","modified":"2025-10-21T22:55:30.414Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-38809","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.","status":"published","published":"2025-02-04T09:55:38Z","modified":"2025-10-21T22:55:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2025-02-11","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-r9jg-gp7p-hp34","title":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI...","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.","status":"published","published":"2025-02-04T12:30:59Z","modified":"2025-10-22T00:34:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2024-40890","title":"Zyxel DSL CPE OS Command Injection Vulnerability","description":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.","cwes":["CWE-78"],"kev":{"date_added":"2025-02-11","due_date":"2025-03-04","required_action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2024-40890","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.","status":"published","published":"2025-02-04T10:15:08.717Z","modified":"2026-06-17T07:46:48.077Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:44.033107Z"}]}}