CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability
UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C020170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
Other sources
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40890?
CVE-2024-40890 is classified as a critical vulnerability due to its potential to allow authenticated attackers to execute OS commands.
How do I fix CVE-2024-40890?
To mitigate CVE-2024-40890, users should upgrade to the latest firmware version provided by Zyxel, if available.
Who is affected by CVE-2024-40890?
CVE-2024-40890 affects the Zyxel VMG4325-B10A device running firmware version 1.00(AAFR.4)C0_20170615.
Can CVE-2024-40890 be exploited remotely?
CVE-2024-40890 requires authentication, so exploitation must be carried out by an attacker with valid user credentials.
Is there a known public exploit for CVE-2024-40890?
Yes, there are reports indicating that attackers are actively exploiting CVE-2024-40890 in the wild.