CVE-2024-40890
ZY
Zyxel DSL CPE Devices
Zyxel DSL CPE OS Command Injection Vulnerability
What it is
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
What to do
The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Vendor notices and references
- www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-in
- www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-comma
- nvd.nist.gov/vuln/detail/CVE-2024-40890
Description and required action as published by CISA. Full record at NVD.
Other Zyxel entries on the list
- GS1900 Series Switches Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability CVE-2026-7273 · Sep 21, 2026
- DSL CPE Devices Zyxel DSL CPE OS Command Injection Vulnerability CVE-2024-40891 · Feb 11, 2025
- Multiple Firewalls Zyxel Multiple Firewalls Path Traversal Vulnerability CVE-2024-11667 · Dec 3, 2024
- EMG2926 Routers Zyxel EMG2926 Routers Command Injection Vulnerability CVE-2017-6884 · Sep 18, 2023
- P660HN-T1A Routers Zyxel P660HN-T1A Routers Command Injection Vulnerability CVE-2017-18368 · Aug 7, 2023
- Multiple Network-Attached Storage (NAS) Devices Zyxel Multiple NAS Devices Command Injection Vulnerability CVE-2023-27992 · Jun 23, 2023