CVE-2024-40891: Zyxel legacy DSL CPE OS command injection via Telnet

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a high EPSS percentile and allows full command execution, but requires valid credentials and affects unsupported legacy devices.

What it is

A post-authentication OS command injection flaw exists in the management commands of legacy Zyxel DSL CPE firmware (VMG4325-B10A version 1.00(AAFR.4)C0_20170615 and related models). An authenticated attacker can inject and execute operating system commands on the device through Telnet. The product line is marked unsupported when assigned, so no vendor fix is expected for affected units.

Impact

An attacker with valid credentials gains arbitrary OS command execution on the device, giving full control of confidentiality, integrity and availability of the CPE. That enables persistent manipulation of the device and any traffic or management functions it handles.

Attack surface

Reached over the network via the Telnet management interface; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated session is required and no user interaction is needed. The description confirms the vector is Telnet and the flaw is post-authentication.

Exploitation

Listed in CISA KEV (added 2025-02-11, due 2025-03-04) with no known ransomware campaign use, and EPSS 30-day probability is 0.21536 (97.5th percentile), indicating elevated likelihood of exploitation. References are vendor advisory and US Government resource only.

What to do

• Retire or replace affected legacy DSL CPE models, since the product line is unsupported and no patch is expected.
• If retirement is not immediately possible, disable Telnet management and restrict management access to trusted internal networks only.
• Change default and weak credentials and enforce strong unique admin passwords to reduce the authenticated foothold needed.
• Segment or isolate affected CPE devices from sensitive networks and monitor them as untrusted endpoints.
• Track the CISA KEV due date (2025-03-04) and confirm remediation or removal status for each affected device.

Detection

• Monitor Telnet logins to CPE management interfaces for unexpected source IPs or unusual times.
• Alert on suspicious command strings or shell metacharacters in management command traffic where Telnet can be inspected.
• Watch for unexpected outbound connections or process activity originating from CPE devices.
• Audit device configuration changes and new accounts on affected Zyxel DSL CPE units.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.