CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
Bekannt ausgenutzt — Zyxel DSL CPE OS Command Injection Vulnerability
CISA hat am 11.02.2025 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 04.03.2025.
Erforderliche Maßnahme: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40891
Beschreibung
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| zyxel | sbg3300-n000 firmware | — | |
| zyxel | sbg3300-nb00 firmware | — | |
| zyxel | sbg3500-n000 firmware | — | |
| zyxel | sbg3500-nb00 firmware | — | |
| zyxel | vmg1312-b10a firmware | — | |
| zyxel | vmg1312-b10b firmware | — | |
| zyxel | vmg1312-b10e firmware | — | |
| zyxel | vmg3312-b10a firmware | — | |
| zyxel | vmg3313-b10a firmware | — | |
| zyxel | vmg3926-b10b firmware | — | |
| Zyxel | VMG4325-B10A firmware | <= 1.00(AAFR.4)C0_20170615 | |
| zyxel | vmg4380-b10a firmware | — | |
| zyxel | vmg8324-b10a firmware | — | |
| zyxel | vmg8924-b10a firmware | — |
Referenzen und Patches
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and… vendor-advisoryVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891 US Government Resource
CPE-Treffer (NVD) (14)
cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*