CVE-2024-40891

🗓️ 04 Feb 2025 10:02:48Reported by ZyxelType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 202 Views

Post-authentication command injection vulnerability in Zyxel VMG4325-B10A firmware allows OS command execution.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2024-40891	4 Feb 202500:00	–	attackerkb
BDU FSTEC	The vulnerability of Zyxel network device software of the CPE series exists due to the lack of measures taken to neutralize special elements used in the operating system commands. This allows attackers to execute arbitrary commands.	30 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Zyxel network device software of the CPE series exists due to the lack of measures taken to neutralize special elements used in the operating system commands. This allows attackers to execute arbitrary commands.	11 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-40891	28 Jan 202521:13	–	circl
CISA KEV Catalog	Zyxel DSL CPE OS Command Injection Vulnerability	11 Feb 202500:00	–	cisa_kev
CISA	CISA Adds Four Known Exploited Vulnerabilities to Catalog	11 Feb 202512:00	–	cisa
CNNVD	Zyxel VMG4325-B10A 操作系统命令注入漏洞	4 Feb 202500:00	–	cnnvd
Cvelist	CVE-2024-40891	4 Feb 202510:02	–	cvelist
NVD	CVE-2024-40891	4 Feb 202510:15	–	nvd
Positive Technologies	PT-2025-1302	27 Jan 202500:00	–	ptsecurity

NVD

Node

zyxel vmg1312-b10a_firmwareMatch-

AND

zyxel vmg1312-b10aMatch-

Node

zyxel vmg1312-b10b_firmwareMatch-

AND

zyxel vmg1312-b10bMatch-

Node

zyxel vmg1312-b10e_firmwareMatch-

AND

zyxel vmg1312-b10eMatch-

Node

zyxel vmg3312-b10a_firmwareMatch-

AND

zyxel vmg3312-b10aMatch-

Node

zyxel vmg3313-b10a_firmwareMatch-

AND

zyxel vmg3313-b10aMatch-

Node

zyxel vmg3926-b10b_firmwareMatch-

AND

zyxel vmg3926-b10bMatch-

Node

zyxel vmg4325-b10a_firmwareMatch-

AND

zyxel vmg4325-b10aMatch-

Node

zyxel vmg4380-b10a_firmwareMatch-

AND

zyxel vmg4380-b10aMatch-

Node

zyxel vmg8324-b10a_firmwareMatch-

AND

zyxel vmg8324-b10aMatch-

Node

zyxel vmg8924-b10a_firmwareMatch-

AND

zyxel vmg8924-b10aMatch-

Node

zyxel sbg3300-n000_firmwareMatch-

AND

zyxel sbg3300-n000Match-

Node

zyxel sbg3300-nb00_firmwareMatch-

AND

zyxel sbg3300-nb00Match-

Node

zyxel sbg3500-n000_firmwareMatch-

AND

zyxel sbg3500-n000_firmwareMatch-

Node

zyxel sbg3500-nb00_firmwareMatch-

AND

zyxel sbg3500-nb00Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "VMG4325-B10A firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "<= 1.00(AAFR.4)C0_20170615"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

27 Oct 2025 17:04Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.8

EPSS0.53243

SSVC