{"id":"CVE-2024-40890","kind":"vulnerability","aliases":["CVE-2024-40890"],"related":[],"title":"**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy…","description":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.\n\nCISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","summary":"Multiple Zyxel DSL CPE devices have an OS command injection flaw in a CGI program that lets an authenticated user run commands on the device through a crafted HTTP request. CISA lists it as actively exploited in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2025-02-11T00:00:00+00:00","products":[{"name":"Zyxel DSL CPE Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg1312-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg1312-b10b firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg1312-b10e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg3312-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg3313-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg3926-b10b firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg4325-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg4380-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg8324-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg8924-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3300-n000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3300-nb00 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3500-n000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3500-nb00 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dsl-cpe","exploited","infrastructure","isp-equipment","routers","zyxel"],"not_affected_if":["managed-hosting","no-zyxel-dsl-devices"],"how_to_check":"Identify Zyxel DSL CPE models in your estate and compare them against the affected product list in the vendor advisory; unknown whether the sources give a firmware version check.","fix":"Apply the vendor's patched firmware if one exists for your model.","status":"open","published_at":"2025-02-04T10:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:30+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:52:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown from sources; CISA says to discontinue use of the product if no current mitigation is available, since it may be end-of-life or end-of-service.\nApply the vendor's patched firmware if one exists for your model.","reach":"network","impact":"high","summary":"Multiple Zyxel DSL CPE devices have an OS command injection flaw in a CGI program that lets an authenticated user run commands on the device through a crafted HTTP request. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["zyxel","dsl-cpe","routers","isp-equipment"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker runs arbitrary OS commands on the device","analyst_note":"Find the Zyxel advisory and the affected and fixed firmware versions per model, and confirm whether any models are EoL with no patch; check the CISA KEV entry for due date.","how_to_check":"Identify Zyxel DSL CPE models in your estate and compare them against the affected product list in the vendor advisory; unknown whether the sources give a firmware version check.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-zyxel-dsl-devices","managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":2672,"output_tokens":471,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':19A,22A '-40890':20A,23A 'action':181C 'activ':142B 'allow':166C 'and/or':192C 'assign':3A 'attack':169C 'authent':7A,126B,156C,168C 'b10a':31A,46A,51A,61A,66A,71A,76A 'b10b':36A,56A 'b10e':41A 'cgi':13A,121B,162C 'cisa':138B,179C 'command':8A,116B,129B,157C,173C 'contain':152C 'could':165C,185C 'cpe':26A,100B,111B,150C 'craft':135B,176C 'current':205C 'cve':18A,21A 'devic':112B,132B,151C 'devices':27A 'discontinu':200C 'dsl':25A,99B,110B,149C 'dsl-cpe':98B 'end':188C,194C 'end-of-lif':187C 'end-of-servic':193C 'eo':197C 'eol':191C 'equip':105B 'execut':171C 'exploit':101B,143B 'firmware':32A,37A,42A,47A,52A,57A,62A,67A,72A,77A,82A,87A,92A,97A 'flaw':118B 'http':136B,177C 'impact':183C 'infrastructur':102B 'inject':9A,117B,158C 'isp':104B 'isp-equip':103B 'legaci':17A 'let':124B 'life':190C 'list':139B 'mitig':206C 'multipl':108B,147C 'n000':81A,91A 'nb00':86A,96A 'os':115B,172C 'post':6A,155C 'post-authent':5A,154C 'product':184C,201C 'program':14A,122B,163C 'request':137B,178C 'requir':180C 'router':106B 'run':128B 'sbg3300':80A,85A 'sbg3300-n000':79A 'sbg3300-nb00':84A 'sbg3500':90A,95A 'sbg3500-n000':89A 'sbg3500-nb00':94A 'servic':196C 'unavail':208C 'unsupport':1A 'user':127B,198C 'util':202C 'via':174C 'vmg1312':30A,35A,40A 'vmg1312-b10a':29A 'vmg1312-b10b':34A 'vmg1312-b10e':39A 'vmg3312':45A 'vmg3312-b10a':44A 'vmg3313':50A 'vmg3313-b10a':49A 'vmg3926':55A 'vmg3926-b10b':54A 'vmg4325':60A 'vmg4325-b10a':59A 'vmg4380':65A 'vmg4380-b10a':64A 'vmg8324':70A 'vmg8324-b10a':69A 'vmg8924':75A 'vmg8924-b10a':74A 'vulner':10A,159C 'wild':146B 'zyxel':24A,28A,33A,38A,43A,48A,53A,58A,63A,68A,73A,78A,83A,88A,93A,107B,109B,148C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-02-04T10:15:08+00:00","kev":{"dateAdded":"2025-02-11","dueDate":"2025-03-04","requiredAction":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@zyxel.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-40890","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-40890","severity":null,"published_at":"2025-02-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:33+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-40890","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40890","severity":null,"published_at":"2025-02-04T10:15:08+00:00","modified_at":"2026-06-17T07:46:48+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}