CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability
UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C020170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Other sources
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Zyxel VMG4325-B10A firmware 1.00(AAFR.4)C0_20170615from your environment.Discontinue product utilization of Zyxel VMG4325-B10A devices running firmware 1.00(AAFR.4)C0_20170615. Remove or replace affected devices from production environments if no current mitigation is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40891?
The severity of CVE-2024-40891 is considered high due to its potential for command injection by authenticated attackers.
How do I fix CVE-2024-40891?
To fix CVE-2024-40891, it is recommended to upgrade to a newer firmware version that addresses this vulnerability.
Which devices are affected by CVE-2024-40891?
CVE-2024-40891 specifically affects the Zyxel VMG4325-B10A device running firmware version 1.00(AAFR.4)C0_20170615.
What type of vulnerability is CVE-2024-40891?
CVE-2024-40891 is a post-authentication command injection vulnerability.
Can CVE-2024-40891 be exploited remotely?
CVE-2024-40891 requires authentication, so it cannot be exploited remotely without valid access credentials.