erroneo.us
Search all guides⌘K

Security Digest · Feb 4, 2025 · Vulnerability · Network edge

Zyxel EOL DSL CPE CVE-2024-40891/40890: No Fix, Exploited

Command injection in twelve end-of-life Zyxel VMG/SBG DSL gateways, chained with default logins and used by Mirai. No patch will ship: replace or isolate.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Act now

There is no patch and Zyxel will not make one, while botnets carry the exploit: any of these old Zyxel DSL gateways still in service should be replaced, and cut off from remote access until it is.

Who must act: Anyone, including ISPs, MSPs and small offices, still running a Zyxel VMG1312, VMG3312, VMG3313, VMG3926, VMG4325, VMG4380, VMG8324, VMG8924, SBG3300 or SBG3500 gateway.

Who can relax: Owners of other, supported Zyxel models; Zyxel's advisory names only these twelve legacy DSL CPE models.

Affected
Zyxel VMG1312-B10A, VMG1312-B10B, VMG1312-B10E
Zyxel VMG3312-B10A, VMG3313-B10A, VMG3926-B10B
Zyxel VMG4325-B10A (VulnCheck tested firmware 1.00(AAFR.4)C0_20170615), VMG4380-B10A
Zyxel VMG8324-B10A, VMG8924-B10A
Zyxel SBG3300, SBG3500
All firmware versions (models are end-of-life)
Fixed in
None: Zyxel will not patch these end-of-life models and advises replacing them
CVSS
8.8 (v3.1, CNA)
EPSS
22.9% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Find every affected Zyxel model on your networks and customer sites (device label, web UI or Telnet login banner).
  2. Replace them with supported hardware; if an ISP supplied the device, ask the ISP for a replacement, as Zyxel advises.
  3. Until replaced, disable remote (WAN) management and Telnet, and block inbound TCP 23 and the web admin ports upstream.
  4. Change the admin and zyuser passwords from the default 1234, and assume the hidden supervisor account still has its default password.
  5. Treat any unit that had Telnet or web management open to the internet as compromised: factory-reset it and retire it first.

How to check if you are affected or compromised

  • From outside, check whether your public IPs answer on TCP 23 with a Zyxel VMG or SBG login banner (nc -v <public-ip> 23).
  • Review edge firewall or NetFlow logs for inbound Telnet sessions to the gateway and for the gateway itself scanning or connecting to unknown hosts, typical of Mirai bots.
  • Compare source IPs in your logs with GreyNoise's tag for CVE-2024-40891.

What happened#

On January 28, 2025, GreyNoise reported attackers exploiting CVE-2024-40891, a command injection in the Telnet service of Zyxel DSL customer premises equipment (CPE). Its HTTP counterpart, CVE-2024-40890, hits the web CGI program. Neither had a patch. GreyNoise said both run commands through the built-in supervisor and zyuser service accounts, and a day later confirmed some Mirai botnet strains had added the exploit.

VulnCheck, which found the bugs, published details on February 4, 2025. The Telnet CLI only checks that a command starts with an allowed word such as ping or tftp, so ping ; sh opens a shell. Default accounts (admin:1234, zyuser:1234 and a hidden supervisor:zyad1234, tracked as CVE-2025-0890) turn that post-login bug into unauthenticated code execution.

The same day, Zyxel's advisory confirmed twelve affected models but said they "have reached end-of-life (EOL) for years," and offered no fix. The CVE records (CVE-2024-40891, CVE-2024-40890) are tagged "UNSUPPORTED WHEN ASSIGNED" and carry Zyxel's CVSS 3.1 score of 8.8. NVD has not added its own score. CISA added both to KEV (40891, 40890) on February 11, 2025. Its required action: stop using the products if no mitigation exists.

Who is affected#

Zyxel lists VMG1312-B10A/B10B/B10E, VMG3312-B10A, VMG3313-B10A, VMG3926-B10B, VMG4325-B10A, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, SBG3300 and SBG3500, many of them ISP-supplied. It notes that WAN access and Telnet are off by default, so the devices at real risk are those where someone turned remote management on. VulnCheck cited FOFA and Censys counts of about 1,500 with internet-facing Telnet, and noted some models were still on sale through Amazon. Current exposure numbers are not disclosed as of Oct 23, 2026.

Do you really need to act?#

If you own one, yes. Zyxel's only remedy is replacement. The exploit ships in Mirai variants, and a hijacked gateway sits in front of every device behind it. Turning off WAN Telnet and web access and changing passwords blocks the known path, but it is a stopgap on hardware that gets no more fixes.

If you don't run these models, there is nothing to do. ISPs and MSPs should check their installed base; end users rarely know their gateway model.

What to do now#

  1. Inventory gateways by model; VulnCheck's test unit shows Zyxel VMG4325-B10A in its Telnet banner. ISPs can pull model lists from device-management systems.
  2. Replace affected units with supported hardware. If the ISP supplied yours, contact the ISP, as Zyxel advises.
  3. Until then, disable remote management and Telnet, and block inbound TCP 23 and the admin web ports upstream. Verify from outside with nc -vz <public-ip> 23.
  4. Change the admin and zyuser passwords. VulnCheck says the supervisor account is not visible in the web interface, so assume its default still works.
  5. If a unit had Telnet or web management open to the internet, factory-reset it and move it to the top of the replacement list.

How to tell if you were hit#

Look at the network around the device. Check edge firewall or NetFlow data for inbound Telnet sessions to the gateway from unknown addresses. Then check for the gateway itself scanning port 23 or other ports, or talking to hosts you do not recognize, which is typical of a Mirai bot. Compare source IPs in your logs with the addresses on GreyNoise's tag for CVE-2024-40891. If you confirm an infection, treat traffic through that router as exposed.

Timeline#

  • — VulnCheck contacts Zyxel about the VMG4325-B10A, according to Zyxel's timeline.
  • — VulnCheck discloses CVE-2024-40891 to its partners, according to GreyNoise.
  • — GreyNoise reports active exploitation. Its January 29 update ties the activity to Mirai.
  • — Zyxel's advisory says no fix is coming. The CVE records and VulnCheck's write-up are published.
  • — CISA adds both CVEs to KEV, with a March 4 federal deadline.

Vulnerability records

  • CVE-2024-40891 · KEV 2025-02-11 · **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A…
  • CVE-2024-40890 · KEV 2025-02-11 · **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Zyxel — Security advisory for command injection and insecure default credentials vulnerabilities in certain legacy DSL CPE zyxel.com
  2. CVE record — CVE-2024-40891 cve.org
  3. CVE record — CVE-2024-40890 cve.org
  4. NVD — CVE-2024-40891 nvd.nist.gov
  5. NVD — CVE-2024-40890 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2024-40891 cisa.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2024-40890 cisa.gov
  8. VulnCheck — Zyxel Telnet Vulnerabilities vulncheck.com
  9. GreyNoise — Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891) greynoise.io