CyberSec.Space Logo
返回 CVE 浏览器

CVE-2024-40890

🔥 Known Exploited (CISA KEV)HIGH
8.8
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-02-04
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

Affected Platforms (CPE)

💻
Zyxel

Vmg1312 B10a Firmware

All versions
💻
Zyxel

Vmg1312 B10b Firmware

All versions
💻
Zyxel

Vmg1312 B10e Firmware

All versions
💻
Zyxel

Vmg3312 B10a Firmware

All versions

References & Advisories

🔗 https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890

相关漏洞威胁

CVE-2026-658937.0

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with ...

CVE-2026-645208.4

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The ...

CVE-2026-645168.8

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCP...

CVE-2026-64511

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference Afte...