CVE-2024-40890

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.207 · 98 %ileEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

20.7% (98th) EPSS

CVSS 9.8 · critical

Is it mine?

16 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2025-02-11remediate by 2025-03-04

required action The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

EPSS · scored 2026-10-27

Zyxel DSL CPE OS Command Injection Vulnerability

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.8–9.8

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · security@zyxel.com.twexploitability 2.8 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USCWE-78US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

affected products (16)

Products and version ranges known to be affected.

Zyxel VMG4325-B10A firmware≤ ≤ 1.00(AAFR.4)C0_20170615enisa_euvdEU
Zyxel Communications Corp. Zyxel CPE Seriesall versionsfstec_bduRU
zyxel sbg3300-n000 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3300-n000_firmware:*:*:*:*:*:*:*:*
zyxel sbg3300-nb00 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3300-nb00_firmware:*:*:*:*:*:*:*:*
zyxel sbg3500-n000 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3500-n000_firmware:*:*:*:*:*:*:*:*
zyxel sbg3500-nb00 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3500-nb00_firmware:*:*:*:*:*:*:*:*
zyxel vmg1312-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg1312-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg1312-b10b firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg1312-b10b_firmware:*:*:*:*:*:*:*:*
zyxel vmg1312-b10e firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg1312-b10e_firmware:*:*:*:*:*:*:*:*
zyxel vmg3312-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg3312-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg3313-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg3313-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg3926-b10b firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg3926-b10b_firmware:*:*:*:*:*:*:*:*
zyxel vmg4325-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg4325-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg4380-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg4380-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg8324-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg8324-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg8924-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg8924-b10a_firmware:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2025-02-04modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan