Background exploitation KEV catalog

CVE-2024-40890

Zyxel DSL CPE OS Command Injection Vulnerability

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute…

CheckOps priority index

5.9/10 Patch within 7 days

Severity8.8

Probability2.1

Exploitation3/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 20.7% higher than 97.5% of CVEs

CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:

Exploited for 630 days 11 Feb 2025

CISA due date 04 Mar 2025 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 3 / 5

KEV catalog (CISA)11 Feb 2025
Exploited in EUVD (ENISA)11 Feb 2025
Used by ransomwareno
EPSS above 10 %20.7%
No account, over the networkno

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Affected products

VMG4325-B10A firmwareDSL CPE Devices

Affected versions

≤ 1.00(AAFR.4)C0_20170615

Weaknesses (CWE)

CWE-78

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

04 Feb 2025
Published
11 Feb 2025
Exploitation reported (ENISA)
11 Feb 2025
Added to the KEV catalog
04 Mar 2025
CISA remediation due date
25 Sept 2026
EPSS peak: 20.7%

References

Other exploited vulnerabilities from the same vendor

CVE-2026-7273Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
4.8 · Actively exploited
CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
6.0 · Background exploitation
CVE-2024-11667Zyxel Multiple Firewalls Path Traversal Vulnerability
5.5 · Background exploitation
CVE-2017-6884Zyxel EMG2926 Routers Command Injection Vulnerability
6.9 · Background exploitation
CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability
9.2 · Background exploitation
CVE-2023-27992Zyxel Multiple NAS Devices Command Injection Vulnerability
8.8 · Background exploitation