CVE-2024-40891
Estado: AnalizadaAlta (8.8)⚠ Explotación activa
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 22%
- Percentil entre todas las CVEs puntuadas: 98
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
CISA KEV — explotada activamente
- Añadida al catálogo: 11/2/2025
- Plazo de remediación: 4/3/2025
- Uso conocido en ransomware: Unknown
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement75 % - Impacto principal
T1059Command and Scripting Interpreterexecution85 % - Impacto secundario
T1098Account Manipulationpersistence · privilege escalation45 %
Post-auth command injection (CWE-78) en CPE Zyxel; AV:N+PR:L permite T1210 (explotación de servicio remoto con autenticación). T1059 confirmado por inyección OS directa vía Telnet. T1098 secundario por potencial control de cuenta tras RCE.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (14)
Zyxel — Sbg3300-n000 FirmwareZyxel — Sbg3300-nb00 FirmwareZyxel — Sbg3500-n000 FirmwareZyxel — Sbg3500-nb00 FirmwareZyxel — Vmg1312-b10a FirmwareZyxel — Vmg1312-b10b FirmwareZyxel — Vmg1312-b10e FirmwareZyxel — Vmg3312-b10a FirmwareZyxel — Vmg3313-b10a FirmwareZyxel — Vmg3926-b10b FirmwareZyxel — Vmg4325-b10a FirmwareZyxel — Vmg4380-b10a FirmwareZyxel — Vmg8324-b10a FirmwareZyxel — Vmg8924-b10a Firmware
CWE
- CWE-78
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-40891",
"cveTags": [
{
"tags": [
"unsupported-when-assigned"
],
"sourceIdentifier": "security@zyxel.com.tw"
}
],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-40891",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-02-11T19:02:48.530465Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security@zyxel.com.tw",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@zyxel.com.tw",
"affectedData": [
{
"vendor": "Zyxel",
"product": "VMG4325-B10A firmware",
"versions": [
{
"status": "affected",
"version": "<= 1.00(AAFR.4)C0_20170615"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2025-02-04T10:15:08.920",
"references": [
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025",
"tags": [
"Vendor Advisory"
],
"source": "security@zyxel.com.tw"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891",
"tags": [
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "security@zyxel.com.tw",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet."
},
{
"lang": "es",
"value": "**NO SOPORTADO CUANDO SE ASIGNÓ** Una vulnerabilidad de inyección de comandos posterior a la autenticación en los comandos de administración de la versión de firmware 1.00(AAFR.4)C0_20170615 del CPE DSL heredado Zyxel VMG4325-B10A podría permitir que un atacante autenticado ejecute comandos del sistema operativo (OS) en un dispositivo afectado a través de Telnet."
}
],
"lastModified": "2026-06-17T07:46:48.213",
"cisaActionDue": "2025-03-04",
"cisaExploitAdd": "2025-02-11",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8CC0C61-EB6A-4736-80E3-B69693D4A2B1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg1312-b10a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7B6C4A31-3B83-444F-B5F8-1397B43B2211"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8EF1C4A6-0305-4759-8DEC-92EB3D2915B1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg1312-b10b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6B193DF7-5EE9-4A78-A01E-753463665627"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2DF4827D-405E-4D21-A17E-A201EC6F79F3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg1312-b10e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "155187EA-4A46-4850-B983-BCE245D57777"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7AC711D-503A-48F9-A523-193F29B9DB22"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg3312-b10a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FFD9DF7D-E6E8-4261-8BD7-12A1AE8839BD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DDEC1767-C8D9-495F-B809-FCDB39DCF98B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg3313-b10a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "46446AE5-EBC1-4E4C-A30F-C610C3EB0975"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7120E86-98DC-4824-BF59-02234501EA29"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg3926-b10b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B1DAF061-1975-4A5B-8206-1E9836DBA1B0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B88B7A0D-D194-47D1-9D78-682EDFC52B52"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg4325-b10a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "135700AF-7EC0-4E94-8552-B6F1038DE4A8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4808FDF8-4815-4C4F-AFE7-31EADE517B31"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg4380-b10a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "88BA2BDF-9ACA-4F89-B7B7-FD232A6399CD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FF0AFA0F-D126-4D1C-89EC-878AB0F5E74C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg8324-b10a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "53C32749-82A6-42AA-9EBE-11014F161D2F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11BEC42C-7815-4EA3-B1E5-66E2443B5032"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "96DC6BBF-15B8-496F-85FE-5373B6CEDC3C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "852E8F04-4C28-4904-AA4A-ACE4EAD6DC31"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:sbg3300-n000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "902A735D-2D84-4183-B4B3-FA36AD9F13A5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B338AE18-ECE4-4B90-A1D5-16F2983464E7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:sbg3300-nb00:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E4658399-1699-4426-ACFF-BDEE20BF1A54"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BC4B86C-ED2F-406D-BCAA-B970BAD248D8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2BC4B86C-ED2F-406D-BCAA-B970BAD248D8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD0DECE6-7AFC-4E86-9FFE-1215ECF8324D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:sbg3500-nb00:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5185679F-9FBC-4B2E-AE79-1471EB56E46A"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "security@zyxel.com.tw",
"cisaRequiredAction": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.",
"cisaVulnerabilityName": "Zyxel DSL CPE OS Command Injection Vulnerability"
}