CVE-2024-40890 | Attaxion

CISA Known Exploited Vulnerability (KEV)

Name

Zyxel DSL CPE OS Command Injection Vulnerability

Exploit added

February 11, 2025

Action due

March 4, 2025

Action required

The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

Description

**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025

Weakness Enumeration

CWE-ID	CWE Name
CWE-78	Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

Known Affected Software Configurations

cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:::::::*
cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:::::::*
cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:::::::*
cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:::::::*
cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:::::::*

Details

Source:
NVD

Published:
February 4, 2025

Updated:
February 12, 2025

Risk information

CVSS v3

Base score:
8.8

Severity:

HIGH

Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2

Not defined