CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
Aktif olarak istismar ediliyor — Zyxel DSL CPE OS Command Injection Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 11.02.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 04.03.2025.
Gerekli işlem: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable. https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40891
Açıklama
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| zyxel | sbg3300-n000 firmware | — | |
| zyxel | sbg3300-nb00 firmware | — | |
| zyxel | sbg3500-n000 firmware | — | |
| zyxel | sbg3500-nb00 firmware | — | |
| zyxel | vmg1312-b10a firmware | — | |
| zyxel | vmg1312-b10b firmware | — | |
| zyxel | vmg1312-b10e firmware | — | |
| zyxel | vmg3312-b10a firmware | — | |
| zyxel | vmg3313-b10a firmware | — | |
| zyxel | vmg3926-b10b firmware | — | |
| Zyxel | VMG4325-B10A firmware | <= 1.00(AAFR.4)C0_20170615 | |
| zyxel | vmg4380-b10a firmware | — | |
| zyxel | vmg8324-b10a firmware | — | |
| zyxel | vmg8924-b10a firmware | — |
Kaynaklar ve yamalar
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and… vendor-advisoryVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891 US Government Resource
CPE eşleşmeleri (NVD) (14)
cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*