HIGHCVSS 8.8Actively exploited · CISA KEV since 2025-02-11Vulnerability

CVE-2024-40891

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.

Properties

Euvd product
VMG4325-B10A firmware
Vulnerability name
Zyxel DSL CPE OS Command Injection Vulnerability
First seen
2025-10-21T22:55:30+00:00
Cvss score
8.8
Epss score
0.21702
Last seen
2026-10-19T12:00:27+00:00
Due date
2025-03-04
Euvd assigner
Zyxel
Retrieved at
2026-10-21T01:24:47+00:00
Exploited euvd since
2025-02-11T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2025-02-11
Score
8.8
Euvd base score version
3.1
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
Zyxel
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
8.8

Related Entities (30 · showing 23)

AFFECTS_PRODUCT (27 · showing 20)

→[Product]cpe:2.3:h:zyxel:vmg3313-b10a:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:vmg4325-b10a:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:vmg4380-b10a:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:vmg3312-b10a:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:vmg3926-b10b:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:sbg3500-nb00:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:sbg3300-n000:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:sbg3300-nb00:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:vmg8324-b10a:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:zyxel:vmg1312-b10e:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*

DESCRIBES (1)

←[KEVEntry]Zyxel DSL CPE OS Command Injection Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

INVOLVES (1)

←[Signal]kev_added · 2025-02-11

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2024-40891 (CVSS 8.8) — Ninja Signal Threat Intelligence | Ninja Signal