**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B
Affects Zyxel VMG4325-B10A firmware up to 1.00(AAFR.4)C0_20170615, a legacy DSL router. No fixed version is listed, and Zyxel advises replacing the device with newer-generation equipment.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Zyxel VMG4325-B10A legacy DSL customer-premises equipment firmware, specifically its CGI program, is affected. An authenticated attacker could exploit this flaw by sending a crafted HTTP POST request to run operating system commands on the device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Zyxel VMG4325-B10A firmware
through 1.00(AAFR.4)C0_20170615
References 1
Questions about CVE-2024-40890
What does this mean?
A command injection flaw in the device's CGI program lets an authenticated attacker run operating system commands on the device.Source: zyxel.com
Am I affected, and how do I check?
Firmware for the Zyxel VMG4325-B10A up to and including 1.00(AAFR.4)C0_20170615 is listed as affected. The attack can only succeed if user-configured passwords have been compromised, so the attacker needs valid login credentials. To check a device, compare its firmware version with 1.00(AAFR.4)C0_20170615.Source: zyxel.com
What should I do about it?
No fixed version is listed. Zyxel advises replacing this legacy product with newer-generation equipment.Source: zyxel.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-02-11, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Disable remote access and change passwords periodically, which Zyxel describes as proactive measures that can help prevent attacks. Zyxel's long-term advice is to replace the legacy device with newer-generation equipment.Source: zyxel.com