CVE-2024-40890

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 22.3%; technical severity is CVSS 8.8.

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

Who should care

• Teams operating DSL CPE Devices, Sbg3300-n000 Firmware, Sbg3300-nb00 Firmware +12 more
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether DSL CPE Devices, Sbg3300-n000 Firmware, Sbg3300-nb00 Firmware +12 more is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from www.zyxel.com
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78

Affected versions

Zyxel DSL CPE Devices; Zyxel Sbg3300-n000 Firmware (Version -); Zyxel Sbg3300-nb00 Firmware (Version -); Zyxel Sbg3500-n000 Firmware (Version -); Zyxel Sbg3500-nb00 Firmware (Version -); Zyxel Vmg1312-b10a Firmware (Version -); Zyxel Vmg1312-b10b Firmware (Version -); Zyxel Vmg1312-b10e Firmware (Version -)

Fixed versions

No explicit fixed version is currently recorded.

Published

4 February 2025

Attack vector

Network

Privileges required

Low

User interaction

None

Signal timeline

1. 4 Feb 2025CVE published
2. 10 Feb 2025Added to CISA KEV
3. 20 Aug 2026Latest EPSS score: 22.3%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 73

External references

• CISA Government advisory CVE-2024-40890 ↗
• Zyxel Technical reference ↗