HIGH

CVE-2024-40890

Zyxel Vmg1312 B10a Firmware 2025-02-04 CVSS v3.1

CVSS

8.8

KEV

Description

**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

Summary dbcve.org

A post-authentication command injection vulnerability exists in the CGI program of Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615. An authenticated attacker can send a crafted HTTP POST request to the CGI program to execute arbitrary OS commands on the affected device.

Mitigation

This is a legacy unsupported device with no vendor patch available. Recommend network segmentation to restrict management interface access, enforce strong authentication, and replace with a supported device.

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

22.25%

Probability of exploitation in next 30 days

97.6th percentile

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE