CVE-2024-40891: Zyxel DSL CPE Devices

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run Zyxel DSL CPE Devices. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2025-02-11, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-03-04; treat that as the outer limit, not the target.
EPSS 22.9%, percentile 98: FIRST’s model estimates a 22.9% chance of exploitation activity in the next 30 days, higher than 98% of all scored CVEs (very high). EPSS is a probability, not a verdict.
Needs an account (low (any account)). Exposure depends on who can log in.

What it is

UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C020170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.

CISA’s summary

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.

Weakness type: CWE-78.

Product: Zyxel DSL CPE Devices · Assigned by: Zyxel · Published: 2025-02-04

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
Zyxel	VMG4325-B10A firmware	<= 1.00(AAFR.4)C0_20170615

Severity scores

Scored by	CVSS	Score	Vector
Zyxel	3.1	8.8 High	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Attack vector: network (remotely reachable)
Attack complexity: low
Privileges required: low (any account)
User interaction: none
Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2025-02-11; federal due date 2025-03-04. Known ransomware use: Unknown.
CISA required action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
CISA SSVC assessment: exploitation active, automatable no, technical impact total.
FIRST EPSS (model of 2026-10-21): 22.89% probability of exploitation activity in the next 30 days; percentile 98.

Timeline

2025-02-04 — CVE record published by Zyxel
2025-02-11 — Added to CISA’s Known Exploited Vulnerabilities catalog
2025-03-04 — CISA remediation deadline for US federal agencies
2025-10-21 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.