CVE-2024-40891

🗓️ 04 Feb 2025 10:02:48Reported by ZyxelType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 300 Views

Post-authentication command injection vulnerability in Zyxel VMG4325-B10A firmware allows OS command execution.

Reporter	Title	Published	Views	Family All 18
attackerkb	CVE-2024-40891	4 Feb 202500:00	–	attackerkb
BDU FSTEC	Zyxel Network Device Command Injection	30 Jan 202500:00	–	bdu_fstec
Circl	CVE-2024-40891	28 Jan 202521:13	–	circl
CISA KEV Catalog	Zyxel DSL CPE OS Command Injection Vulnerability	11 Feb 202500:00	–	cisa_kev
CISA	CISA Adds Four Known Exploited Vulnerabilities to Catalog	11 Feb 202512:00	–	cisa
CNNVD	Zyxel VMG4325-B10A 操作系统命令注入漏洞	4 Feb 202500:00	–	cnnvd
Cvelist	CVE-2024-40891	4 Feb 202510:02	–	cvelist
Kitploit	zyxel-p870hn-hardware-hacking	13 Oct 202609:08	–	kitploit
NVD	CVE-2024-40891	4 Feb 202510:15	–	nvd
Positive Technologies	PT-2025-1302	27 Jan 202500:00	–	ptsecurity

NVD

Node

AND

zyxel vmg1312-b10a_firmwareMatch-

zyxel vmg1312-b10aMatch-

Node

AND

zyxel vmg1312-b10b_firmwareMatch-

zyxel vmg1312-b10bMatch-

Node

AND

zyxel vmg1312-b10e_firmwareMatch-

zyxel vmg1312-b10eMatch-

Node

AND

zyxel vmg3312-b10a_firmwareMatch-

zyxel vmg3312-b10aMatch-

Node

AND

zyxel vmg3313-b10a_firmwareMatch-

zyxel vmg3313-b10aMatch-

Node

AND

zyxel vmg3926-b10b_firmwareMatch-

zyxel vmg3926-b10bMatch-

Node

AND

zyxel vmg4325-b10a_firmwareMatch-

zyxel vmg4325-b10aMatch-

Node

AND

zyxel vmg4380-b10a_firmwareMatch-

zyxel vmg4380-b10aMatch-

Node

AND

zyxel vmg8324-b10a_firmwareMatch-

zyxel vmg8324-b10aMatch-

Node

AND

zyxel vmg8924-b10a_firmwareMatch-

zyxel vmg8924-b10aMatch-

Node

AND

zyxel sbg3300-n000_firmwareMatch-

zyxel sbg3300-n000Match-

Node

AND

zyxel sbg3300-nb00_firmwareMatch-

zyxel sbg3300-nb00Match-

Node

AND

zyxel sbg3500-n000_firmwareMatch-

Node

AND

zyxel sbg3500-nb00_firmwareMatch-

zyxel sbg3500-nb00Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "VMG4325-B10A firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "<= 1.00(AAFR.4)C0_20170615"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

17 Jun 2026 07:46Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.8

EPSS0.21702

SSVC