{"id":"CVE-2024-40891","published":"2025-02-04T10:15:08Z","modified":"2026-06-17T07:46:48Z","title":"Zyxel DSL CPE OS Command Injection Vulnerability","vendor":"Zyxel","product":"DSL CPE Devices","tier":"core","eol":null,"description":{"text":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.","provenance":"source","from":"NVD"},"summary":{"text":"Zyxel DSL CPE devices, specifically the VMG4325-B10A running firmware 1.00(AAFR.4)C0_20170615, contain a command injection flaw in the management commands. The flaw is a legacy issue in an unsupported product. An authenticated attacker can run operating system commands on the affected device via Telnet, so valid credentials are required and the attacker must be able to reach the device's Telnet service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:22Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.22888,"percentile":0.97737,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-02-11","dueDate":"2025-03-04","ransomware":false,"requiredAction":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40891","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-01-28","exploitedFirstSeen":"2025-01-28","ransomware":false,"evidence":[{"url":"https://www.greynoise.io/blog/active-exploitation-of-zero-day-zyxel-cpe-vulnerability-cve-2024-40891","date":"2025-01-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891","tags":["US Government Resource"]}],"techniques":[{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"exploitation_technique","evidence":[],"comment":"Zyxel CPE devices contain a Telnet interface that fails to properly sanitize input containing special characters, which facilitates code execution that can lead to data exfiltration, network infiltration, and total system compromise.","confidence":"high"},{"id":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"primary_impact","evidence":[],"comment":"Zyxel CPE devices contain a Telnet interface that fails to properly sanitize input containing special characters, which facilitates code execution that can lead to data exfiltration, network infiltration, and total system compromise.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-38851","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38851","exploited":true,"exploitedSince":"2025-02-11","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2026-08-13","earliestUrl":"https://github.com/Danyw24/zyxel-p870hn-hardware-hacking","repos":[{"name":"Danyw24/zyxel-p870hn-hardware-hacking","url":"https://github.com/Danyw24/zyxel-p870hn-hardware-hacking","stars":0,"created":"2026-08-13"}]},"first":{"date":"2026-08-13","source":"PoC-in-GitHub","url":"https://github.com/Danyw24/zyxel-p870hn-hardware-hacking"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1055"],"provenance":"source"},{"stage":"primary","techniques":["T1011"],"provenance":"source"}],"timeline":[{"date":"2025-01-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/active-exploitation-of-zero-day-zyxel-cpe-vulnerability-cve-2024-40891","provenance":"source"},{"date":"2025-02-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40891","provenance":"source"},{"date":"2025-02-11","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38851","provenance":"source"},{"date":"2026-08-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Danyw24/zyxel-p870hn-hardware-hacking","provenance":"source"}],"speed":{"daysToPublicExploit":555,"firstExploitFrom":"PoC-in-GitHub","daysToKev":7},"priority":{"score":68.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 641 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.55,"detail":"percentile 0.9774"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}