**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel V
Affects Zyxel VMG4325-B10A firmware up to 1.00(AAFR.4)C0_20170615, a legacy DSL CPE. No fixed version is listed, and Zyxel advises replacing these end-of-life products.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Zyxel VMG4325-B10A legacy DSL customer premises equipment firmware is affected. An authenticated attacker could exploit this flaw through Telnet to run operating system commands on the device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Zyxel VMG4325-B10A firmware
through 1.00(AAFR.4)C0_20170615
References 1
Questions about CVE-2024-40891
What does this mean?
A command injection flaw in the device's management commands lets an authenticated attacker run operating system commands on the device via Telnet.Source: zyxel.com
Am I affected, and how do I check?
Zyxel lists the VMG4325-B10A firmware up to and including 1.00(AAFR.4)C0_20170615. The Telnet function must be enabled, which is disabled by default, and the advisory notes the attack depends on user-configured passwords having been compromised; check the Telnet setting and firmware version in the device's admin interface.Source: zyxel.com
What should I do about it?
The advisory lists no fixed firmware version, so there is no upgrade target. Zyxel advises replacing these end-of-life products.Source: zyxel.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-02-11, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Disable remote access and change passwords periodically, which the advisory describes as proactive measures that can help prevent attacks.Source: zyxel.com