{"id":"CVE-2024-40891","aliases":["EUVD-2024-38851","GHSA-pm4h-579g-cgqq"],"status":"published","title":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the...","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.22748,"percentile":0.97757,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2025-02-04T10:02:48Z","modified":"2026-06-17T07:46:48Z","kev":{"date_added":"2025-02-11","due_date":"2025-03-04","required_action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-02-11"},{"source":"kev","since":"2025-02-11"}],"exploits":[{"source":"pocgithub","id":"Danyw24/zyxel-p870hn-hardware-hacking","title":"Danyw24/zyxel-p870hn-hardware-hacking","date":"2026-08-13","url":"https://github.com/Danyw24/zyxel-p870hn-hardware-hacking"},{"source":"pocgithub","id":"krevetkqqq/CVE-2024-40891","title":"krevetkqqq/CVE-2024-40891","date":"2026-10-30","url":"https://github.com/krevetkqqq/CVE-2024-40891"}],"products":[{"vendor":"zyxel","product":"dsl cpe devices"},{"vendor":"zyxel","product":"sbg3300-n000_firmware"},{"vendor":"zyxel","product":"sbg3300-nb00_firmware"},{"vendor":"zyxel","product":"sbg3500-n000_firmware"},{"vendor":"zyxel","product":"sbg3500-nb00_firmware"},{"vendor":"zyxel","product":"vmg1312-b10a_firmware"},{"vendor":"zyxel","product":"vmg1312-b10b_firmware"},{"vendor":"zyxel","product":"vmg1312-b10e_firmware"},{"vendor":"zyxel","product":"vmg3312-b10a_firmware"},{"vendor":"zyxel","product":"vmg3313-b10a_firmware"},{"vendor":"zyxel","product":"vmg3926-b10b_firmware"},{"vendor":"zyxel","product":"vmg4325-b10a firmware"},{"vendor":"zyxel","product":"vmg4325-b10a_firmware"},{"vendor":"zyxel","product":"vmg4380-b10a_firmware"},{"vendor":"zyxel","product":"vmg8324-b10a_firmware"},{"vendor":"zyxel","product":"vmg8924-b10a_firmware"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40891"},{"url":"https://github.com/advisories/GHSA-pm4h-579g-cgqq"}],"sources":{"cve":[{"id":"CVE-2024-40891","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.","status":"published","published":"2025-02-04T10:02:48.018Z","modified":"2025-10-21T22:55:30.272Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2024-38851","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.","status":"published","published":"2025-02-04T10:02:48Z","modified":"2025-10-21T22:55:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2025-02-11","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-pm4h-579g-cgqq","title":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the...","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.","status":"published","published":"2025-02-04T12:30:59Z","modified":"2025-10-22T00:34:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2024-40891","title":"Zyxel DSL CPE OS Command Injection Vulnerability","description":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.","cwes":["CWE-78"],"kev":{"date_added":"2025-02-11","due_date":"2025-03-04","required_action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2024-40891","description":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.","status":"published","published":"2025-02-04T10:15:08.92Z","modified":"2026-06-17T07:46:48.213Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:44.033107Z"}]}}