Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-40890

high · 8.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

Added 2025-02-11Remediation due 2025-03-04

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

8.8
CVSS
22.3%
EPSS (exploit prob.)
98th
EPSS percentile
2025-02-04
Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

VendorProductAffected versions
zyxelvmg1312-b10a_firmwareall versions
zyxelvmg1312-b10aall versions
zyxelvmg1312-b10b_firmwareall versions
zyxelvmg1312-b10ball versions
zyxelvmg1312-b10e_firmwareall versions
zyxelvmg1312-b10eall versions
zyxelvmg3312-b10a_firmwareall versions
zyxelvmg3312-b10aall versions
zyxelvmg3313-b10a_firmwareall versions
zyxelvmg3313-b10aall versions
zyxelvmg3926-b10b_firmwareall versions
zyxelvmg3926-b10ball versions
zyxelvmg4325-b10a_firmwareall versions
zyxelvmg4325-b10aall versions
zyxelvmg4380-b10a_firmwareall versions
zyxelvmg4380-b10aall versions
zyxelvmg8324-b10a_firmwareall versions
zyxelvmg8324-b10aall versions
zyxelvmg8924-b10a_firmwareall versions
zyxelvmg8924-b10aall versions
zyxelsbg3300-n000_firmwareall versions
zyxelsbg3300-n000all versions
zyxelsbg3300-nb00_firmwareall versions
zyxelsbg3300-nb00all versions
zyxelsbg3500-n000_firmwareall versions
zyxelsbg3500-n000_firmwareall versions
zyxelsbg3500-nb00_firmwareall versions
zyxelsbg3500-nb00all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-40890