IRONSMITHINTEL
HIGHCVSS8.8
|
Actively Exploited
|CISA KEV|CVE-2024-40890|Auth: low — authenticated user|Reboot: required|Manual only

Zyxel DSL CPE Devices < 1.00 — RCE

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.

Published Feb 4, 2025 · Updated May 17, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

A remote attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2025-03-04 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a OS Command Injection (CWE-78) vulnerability in Zyxel DSL CPE Devices. **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request. Exploitation requires remote network access, low attack complexity, a low-privilege authenticated account, and no user interaction required.

Am I affected?Quick check

Probably yes if any of these apply:

●IT Security
●Running vmg1312-b10a firmware: -; vmg1312-b10b firmware: -; vmg1312-b10e firmware: -; vmg3312-b10a firmware: -; vmg3313-b10a firmware: -; vmg3926-b10b firmware: -; vmg4325-b10a firmware: -; vmg4380-b10a firmware: -; vmg8324-b10a firmware: -; vmg8924-b10a firmware: -; sbg3300-n000 firmware: -; sbg3300-nb00 firmware: -; sbg3500-n000 firmware: -; sbg3500-nb00 firmware: -
Fixed in1.00
Real-world incidentsWhat we've seen

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2025-02-11 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2025-03-04.

How to patch

Manual remediation steps

1
Identify affected hosts: query inventory for general installs in scope.
2
Upgrade to version 1.00 or later. Stage in a test ring before broad deployment.
3
Verify by checking the installed version on a sample of remediated hosts.
4
Document the remediation in your change ticket and re-scan with your vulnerability scanner to confirm closure.
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2024-40890↗ MSRC Advisory↗ NVD↗ Vendor Advisory