CVE-2024-40890

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40890
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890 US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg1312-b10a:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg1312-b10b:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg1312-b10e:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg3312-b10a:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg3313-b10a:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg3926-b10b:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg4325-b10a:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg4380-b10a:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg8324-b10a:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:sbg3300-n000:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:sbg3300-nb00:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:sbg3500-nb00:-:*:*:*:*:*:*:*
History

27 Oct 2025, 17:04

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890 - US Government Resource

21 Oct 2025, 23:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:20

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890 -

12 Feb 2025, 18:12

Type Values Removed Values Added
First Time Zyxel vmg8324-b10a Firmware
Zyxel vmg3312-b10a
Zyxel vmg4325-b10a
Zyxel vmg1312-b10a
Zyxel vmg1312-b10b Firmware
Zyxel
Zyxel vmg8924-b10a Firmware
Zyxel sbg3500-nb00
Zyxel vmg4325-b10a Firmware
Zyxel vmg3313-b10a
Zyxel vmg3312-b10a Firmware
Zyxel vmg4380-b10a Firmware
Zyxel sbg3300-nb00 Firmware
Zyxel sbg3300-n000 Firmware
Zyxel vmg1312-b10e Firmware
Zyxel vmg4380-b10a
Zyxel vmg1312-b10e
Zyxel vmg8324-b10a
Zyxel vmg3926-b10b Firmware
Zyxel sbg3500-nb00 Firmware
Zyxel vmg8924-b10a
Zyxel sbg3300-n000
Zyxel vmg3926-b10b
Zyxel sbg3500-n000 Firmware
Zyxel vmg1312-b10a Firmware
Zyxel vmg1312-b10b
Zyxel vmg3313-b10a Firmware
Zyxel sbg3300-nb00
CPE cpe:2.3:h:zyxel:sbg3300-n000:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg1312-b10b:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg1312-b10a:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg3926-b10b:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg4380-b10a:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:sbg3500-nb00:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg3313-b10a:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:sbg3300-nb00:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg8324-b10a:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg1312-b10e:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg3312-b10a:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vmg4325-b10a:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*
References () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 - () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 - Vendor Advisory

12 Feb 2025, 02:00

Type Values Removed Values Added
Summary
  • (es) **NO SOPORTADO CUANDO SE ASIGNÓ** Una vulnerabilidad de inyección de comando posterior a la autenticación en el programa CGI de la versión de firmware 1.00(AAFR.4)C0_20170615 del CPE DSL heredado Zyxel VMG4325-B10A podría permitir que un atacante autenticado ejecute comandos del sistema operativo (SO) en un dispositivo afectado mediante el envío de una solicitud HTTP POST manipulada.

04 Feb 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-04 10:15

Updated : 2025-10-27 17:04

NVD link : CVE-2024-40890

Mitre link : CVE-2024-40890

CVE.ORG link : CVE-2024-40890

JSON object : View

Products Affected

zyxel

  • sbg3300-nb00
  • vmg3926-b10b
  • vmg4380-b10a
  • vmg4325-b10a
  • vmg3313-b10a_firmware
  • sbg3500-nb00_firmware
  • vmg1312-b10b_firmware
  • vmg3313-b10a
  • vmg8924-b10a
  • vmg8924-b10a_firmware
  • vmg1312-b10a_firmware
  • vmg1312-b10e_firmware
  • sbg3300-n000_firmware
  • sbg3300-nb00_firmware
  • vmg4325-b10a_firmware
  • sbg3500-n000_firmware
  • vmg1312-b10e
  • vmg8324-b10a
  • vmg3312-b10a_firmware
  • sbg3300-n000
  • vmg8324-b10a_firmware
  • sbg3500-nb00
  • vmg1312-b10b
  • vmg1312-b10a
  • vmg3926-b10b_firmware
  • vmg4380-b10a_firmware
  • vmg3312-b10a
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')