Live › vulnerability › CVE-2024-40891
Go to dashboardMultiple Zyxel DSL CPE devices (home and small-office broadband modems and routers) let an authenticated user run OS commands through their management commands over Telnet. CISA lists this as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zyxel DSL CPE Devices | vendor | – | – |
| zyxel vmg1312-b10a firmware | vendor | – | – |
| zyxel vmg1312-b10b firmware | vendor | – | – |
| zyxel vmg1312-b10e firmware | vendor | – | – |
| zyxel vmg3312-b10a firmware | vendor | – | – |
| zyxel vmg3313-b10a firmware | vendor | – | – |
| zyxel vmg3926-b10b firmware | vendor | – | – |
| zyxel vmg4325-b10a firmware | vendor | – | – |
| zyxel vmg4380-b10a firmware | vendor | – | – |
| zyxel vmg8324-b10a firmware | vendor | – | – |
| zyxel vmg8924-b10a firmware | vendor | – | – |
| zyxel sbg3300-n000 firmware | vendor | – | – |
| zyxel sbg3300-nb00 firmware | vendor | – | – |
| zyxel sbg3500-n000 firmware | vendor | – | – |
| zyxel sbg3500-nb00 firmware | vendor | – | – |
Identify Zyxel DSL CPE models in use and check whether Telnet access is enabled on them; the sources do not give a specific command or setting.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-40891")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.