Zyxel DSL CPE OS Command Injection Vulnerability (CVE-2024-40891)
Severity: high · Patch status: unpatched · Since 2025-02-11 · CVE-2024-40891
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. CISA added CVE-2024-40891 to its Known Exploited Vulnerabilities catalog on Feb 11, 2025, which means attackers are exploiting it in the wild.
What to do
- The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
- US federal agencies must remediate by Mar 4, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
