CVE-2024-40891 · netVigilance record NV25-0027
Zyxel DSL CPE OS Command Injection
past due
What to do
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
CISA deadline 2025-03-04 · passed 1 year 6 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA
What happened
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
Who is affected
Zyxel DSL CPE Devices. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.
Weakness class: CWE-78.
Timeline
- Added to CISA KEVExploitation in the wild confirmed by CISA
- CISA remediation deadlinepassed 1 year 6 months ago
Sources
- NVD entry for CVE-2024-40891 nvd.nist.gov/vuln/detail/CVE-2024-40891
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
- zyxel.com www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
- zyxel.com www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025
- nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2024-40891