CVE-2024-40890: Zyxel legacy DSL CPE CGI command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCISA KEV listing confirms active exploitation and the flaw yields full command execution, though it requires valid credentials and affects legacy end-of-life devices.

What it is

The CGI program in legacy Zyxel DSL CPE firmware (notably VMG4325-B10A 1.00(AAFR.4)C0_20170615) fails to neutralize input, allowing OS command injection. The flaw is post-authentication, so an attacker who already holds valid credentials can run arbitrary commands on the device. Because the affected products are legacy and unsupported, patching options are limited and exposure persists.

Impact

An authenticated attacker gains arbitrary OS command execution on the CPE, giving full control of the device's confidentiality, integrity and availability. That can enable persistent access, traffic manipulation or use of the device as a pivot into the local network.

Attack surface

Reached over the network via a crafted HTTP POST request to the CGI program; the CVSS vector (AV:N/PR:L/UI:N) indicates no user interaction but a valid low-privileged account is required. The description confirms the vulnerability is post-authentication.

Exploitation

CVE-2024-40890 is listed in CISA KEV (added 2025-02-11), indicating known exploitation in the wild, and EPSS shows a 30-day probability of 0.22251 (97.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor security advisory for legacy DSL CPE; if no fix exists for your model, discontinue use as CISA advises.
• Replace or retire end-of-life Zyxel DSL CPE models that cannot be patched.
• Restrict management and CGI access to trusted networks and disable remote administration where possible.
• Enforce strong unique admin credentials and remove unused accounts to limit post-auth reach.
• Segment or isolate legacy CPE devices so a compromised unit cannot reach other network assets.

Detection

• Monitor CPE and web logs for crafted HTTP POST requests to CGI endpoints containing shell metacharacters.
• Alert on unexpected outbound connections or processes spawned by the CPE's web/CGI service.
• Audit authentication logs for logins from unusual sources preceding command execution activity.
• Inventory network for the listed legacy Zyxel DSL CPE models and flag any still reachable.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.