1. Home
  2. CVE Database
  3. CVE-2024-40890
HIGH · 8.8

CVE-2024-40890

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an ...

Vulnerability Description

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ZyxelVmg1312-B10A Firmware-
ZyxelVmg1312-B10A-
ZyxelVmg1312-B10B Firmware-
ZyxelVmg1312-B10B-
ZyxelVmg1312-B10E Firmware-
ZyxelVmg1312-B10E-
ZyxelVmg3312-B10A Firmware-
ZyxelVmg3312-B10A-
ZyxelVmg3313-B10A Firmware-
ZyxelVmg3313-B10A-
ZyxelVmg3926-B10B Firmware-
ZyxelVmg3926-B10B-
ZyxelVmg4325-B10A Firmware-
ZyxelVmg4325-B10A-
ZyxelVmg4380-B10A Firmware-
ZyxelVmg4380-B10A-
ZyxelVmg8324-B10A Firmware-
ZyxelVmg8324-B10A-
ZyxelVmg8924-B10A Firmware-
ZyxelVmg8924-B10A-

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2024-40890?

CVE-2024-40890 is a vulnerability with a CVSS score of 8.8 (HIGH). **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an ...

How severe is CVE-2024-40890?

CVE-2024-40890 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-40890?

Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Vmg1312-B10A Firmware, Zyxel Vmg1312-B10A, Zyxel Vmg1312-B10B Firmware, Zyxel Vmg1312-B10B, Zyxel Vmg1312-B10E Firmware.