CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability
Zyxel · DSL CPE Devices · NVD published 2025-02-04 · posted 2025-02-11 · last modified 2026-06-17
What it is
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
| Weakness | CWE-78 |
|---|---|
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (source: [email protected]) |
| CISA due date | 2025-03-04 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | Privilege Escalation → Stealth → Exfiltration |
Exploitation evidence
First exploit evidence seen: 2025-02-11 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2025-02-11. Source
Public exploit code
GitHub proof-of-concept repositories below quality bar
1 public repositories from 1 accounts, first seen 2026-08-13.
Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.
Sources: CISA KEV · nomi-sec/PoC-in-GitHub.
Defend the Chain
The attack chain for CVE-2024-40891 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1055 Process Injection CTID: exploitation technique
Zyxel CPE devices contain a Telnet interface that fails to properly sanitize input containing special characters, which facilitates code execution that can lead to data exfiltration, network infiltration, and total system compromise.
How to fix it
CISA required action
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. (source: CISA KEV)
Fixed versions
NVD does not list a fixed version for this CVE. Use the vendor advisory below.
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 (CISA KEV notes)
- https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 (CISA KEV notes)
MITRE ATT&CK mitigations for this chain
- M1026 Privileged Account Management (for T1055) : Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurit
- M1040 Behavior Prevention on Endpoint (for T1055) : Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection.
- M1042 Disable or Remove Feature or Program (for T1011) : Disable WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel in local computer security settings or by group policy if it is not needed within an environment.
- M1028 Operating System Configuration (for T1011) : Prevent the creation of new network adapters where possible.
Detection Generic guidance
- Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.
- Exfiltration: Watch for large or unusual outbound transfers from the affected host.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.