Vulnerabilities CVE-2024-40890

CVE-2024-40890

Medium

Open

KEV

TLP:CLEAR

Zyxel DSL CPE OS Command Injection Vulnerability

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Zyxel — DSL CPE Devices — Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.

Details

EPSS Score ⓘ: 22.25%

97.5th percentile
Confidence: 100%
CISA KEV
Date Added: Feb 11, 2025
Patch Due: Mar 4, 2025
Required Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.