CVE-2024-40891
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Feb 11, 2025
- US federal agencies must remediate it by Mar 4, 2025 (BOD 22-01)
- Attacked 7 days before the vulnerability was made public
- Confirmed by sensors, not only by reports
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Source: CISA KEV · Jan 20, 2026 Feb 11, 2025 Jan 28, 2025
CVSS score8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-78
Vendorszyxel
Affected products
| Vendors | Product | Versions |
|---|---|---|
| zyxel | vmg1312-b10a firmware | - |
| zyxel | vmg1312-b10a | - |
| zyxel | vmg1312-b10b firmware | - |
| zyxel | vmg1312-b10b | - |
| zyxel | vmg1312-b10e firmware | - |
| zyxel | vmg1312-b10e | - |
| zyxel | vmg3312-b10a firmware | - |
| zyxel | vmg3312-b10a | - |
| zyxel | vmg3313-b10a firmware | - |
| zyxel | vmg3313-b10a | - |
| zyxel | vmg3926-b10b firmware | - |
| zyxel | vmg3926-b10b | - |
| zyxel | vmg4325-b10a firmware | - |
| zyxel | vmg4325-b10a | - |
| zyxel | vmg4380-b10a firmware | - |
| zyxel | vmg4380-b10a | - |
| zyxel | vmg8324-b10a firmware | - |
| zyxel | vmg8324-b10a | - |
| zyxel | vmg8924-b10a firmware | - |
| zyxel | vmg8924-b10a | - |
| zyxel | sbg3300-n000 firmware | - |
| zyxel | sbg3300-n000 | - |
| zyxel | sbg3300-nb00 firmware | - |
| zyxel | sbg3300-nb00 | - |
| zyxel | sbg3500-n000 firmware | - |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.