CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2024-40890
High (8.8) in Zyxel DSL CPE Devices. No vendor fix: the product was unsupported when the CVE was assigned. In CISA KEV since 2025-02-11. EPSS 21% chance of exploitation in the next 30 days.
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
Severity
- EPSS
- 21% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-02-11, due 2025-03-04
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:sbg3300-n000_firmware
- zyxel:sbg3300-nb00_firmware
- zyxel:sbg3500-n000_firmware
- zyxel:sbg3500-nb00_firmware
- zyxel:vmg1312-b10a_firmware
- zyxel:vmg1312-b10b_firmware
- zyxel:vmg1312-b10e_firmware
- zyxel:vmg3312-b10a_firmware
- zyxel:vmg3313-b10a_firmware
- zyxel:vmg3926-b10b_firmware
- zyxel:vmg4325-b10a_firmware
- zyxel:vmg4380-b10a_firmware
- zyxel:vmg8324-b10a_firmware
- zyxel:vmg8924-b10a_firmware