Live › vulnerability › CVE-2024-40890
Go to dashboardMultiple Zyxel DSL CPE devices have an OS command injection flaw in a CGI program that lets an authenticated user run commands on the device through a crafted HTTP request. CISA lists it as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zyxel DSL CPE Devices | vendor | – | – |
| zyxel vmg1312-b10a firmware | vendor | – | – |
| zyxel vmg1312-b10b firmware | vendor | – | – |
| zyxel vmg1312-b10e firmware | vendor | – | – |
| zyxel vmg3312-b10a firmware | vendor | – | – |
| zyxel vmg3313-b10a firmware | vendor | – | – |
| zyxel vmg3926-b10b firmware | vendor | – | – |
| zyxel vmg4325-b10a firmware | vendor | – | – |
| zyxel vmg4380-b10a firmware | vendor | – | – |
| zyxel vmg8324-b10a firmware | vendor | – | – |
| zyxel vmg8924-b10a firmware | vendor | – | – |
| zyxel sbg3300-n000 firmware | vendor | – | – |
| zyxel sbg3300-nb00 firmware | vendor | – | – |
| zyxel sbg3500-n000 firmware | vendor | – | – |
| zyxel sbg3500-nb00 firmware | vendor | – | – |
Identify Zyxel DSL CPE models in your estate and compare them against the affected product list in the vendor advisory; unknown whether the sources give a firmware version check.
Apply the vendor's patched firmware if one exists for your model.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-40890")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.