{"id":"CVE-2024-40891","kind":"vulnerability","aliases":["CVE-2024-40891"],"related":[],"title":"**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of…","description":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.\n\nCISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","summary":"Multiple Zyxel DSL CPE devices (home and small-office broadband modems and routers) let an authenticated user run OS commands through their management commands over Telnet. CISA lists this as actively exploited.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2025-02-11T00:00:00+00:00","products":[{"name":"Zyxel DSL CPE Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg1312-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg1312-b10b firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg1312-b10e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg3312-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg3313-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg3926-b10b firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg4325-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg4380-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg8324-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel vmg8924-b10a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3300-n000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3300-nb00 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3500-n000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel sbg3500-nb00 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dsl-cpe","exploited","infrastructure","self-hosted","telnet","zyxel"],"not_affected_if":["non-zyxel-dsl-devices","telnet-disabled"],"how_to_check":"Identify Zyxel DSL CPE models in use and check whether Telnet access is enabled on them; the sources do not give a specific command or setting.","fix":null,"status":"open","published_at":"2025-02-04T10:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:29+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:52:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown; CISA says the product may be end-of-life or end-of-service, and users should discontinue use if no mitigation is available.","reach":"network","impact":"high","summary":"Multiple Zyxel DSL CPE devices (home and small-office broadband modems and routers) let an authenticated user run OS commands through their management commands over Telnet. CISA lists this as actively exploited.","category":"infrastructure","who_cares":["zyxel","dsl-cpe","self-hosted","telnet"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with valid login runs arbitrary OS commands on the device.","analyst_note":"Find the affected model list and vendor fixed firmware versions in Zyxel's advisory for CVE-2024-40891 and confirm whether Telnet is the only vector.","how_to_check":"Identify Zyxel DSL CPE models in use and check whether Telnet access is enabled on them; the sources do not give a specific command or setting.\nunknown","needs_analyst":true,"not_affected_if":["non-zyxel-dsl-devices","telnet-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000479,"input_tokens":2666,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':16A,19A '-40891':17A,20A 'action':169C 'activ':136B 'allow':157C 'and/or':180C 'assign':3A 'attack':160C 'authent':7A,121B,147C,159C 'b10a':28A,43A,48A,58A,63A,68A,73A 'b10b':33A,53A 'b10e':38A 'broadband':115B 'cisa':132B,167C 'command':8A,14A,125B,129B,148C,154C,164C 'contain':143C 'could':156C,173C 'cpe':23A,97B,108B,141C 'current':193C 'cve':15A,18A 'devic':109B,142C 'devices':24A 'discontinu':188C 'dsl':22A,96B,107B,140C 'dsl-cpe':95B 'end':176C,182C 'end-of-lif':175C 'end-of-servic':181C 'eo':185C 'eol':179C 'execut':162C 'exploit':98B,137B 'firmware':29A,34A,39A,44A,49A,54A,59A,64A,69A,74A,79A,84A,89A,94A 'home':110B 'host':102B 'impact':171C 'infrastructur':99B 'inject':9A,149C 'let':119B 'life':178C 'list':133B 'manag':13A,128B,153C 'mitig':194C 'modem':116B 'multipl':105B,138C 'n000':78A,88A 'nb00':83A,93A 'offic':114B 'os':124B,163C 'post':6A,146C 'post-authent':5A,145C 'product':172C,189C 'requir':168C 'router':118B 'run':123B 'sbg3300':77A,82A 'sbg3300-n000':76A 'sbg3300-nb00':81A 'sbg3500':87A,92A 'sbg3500-n000':86A 'sbg3500-nb00':91A 'self':101B 'self-host':100B 'servic':184C 'small':113B 'small-offic':112B 'telnet':103B,131B,166C 'unavail':196C 'unsupport':1A 'user':122B,186C 'util':190C 'via':165C 'vmg1312':27A,32A,37A 'vmg1312-b10a':26A 'vmg1312-b10b':31A 'vmg1312-b10e':36A 'vmg3312':42A 'vmg3312-b10a':41A 'vmg3313':47A 'vmg3313-b10a':46A 'vmg3926':52A 'vmg3926-b10b':51A 'vmg4325':57A 'vmg4325-b10a':56A 'vmg4380':62A 'vmg4380-b10a':61A 'vmg8324':67A 'vmg8324-b10a':66A 'vmg8924':72A 'vmg8924-b10a':71A 'vulner':10A,150C 'zyxel':21A,25A,30A,35A,40A,45A,50A,55A,60A,65A,70A,75A,80A,85A,90A,104B,106B,139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-02-04T10:15:08+00:00","kev":{"dateAdded":"2025-02-11","dueDate":"2025-03-04","requiredAction":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@zyxel.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-40891","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-40891","severity":null,"published_at":"2025-02-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-40891","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40891","severity":null,"published_at":"2025-02-04T10:15:08+00:00","modified_at":"2026-06-17T07:46:48+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}