CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability
MITRE ATT&CK techniques
How this vulnerability maps to adversary behaviour, from the Center for Threat-Informed Defense's public CVE→ATT&CK mappings. Use it to check whether your detections already cover the technique.
Summary
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
Affected software
Vendor: Zyxel · Product: DSL CPE Devices
Weakness types (CWE):
What to do
This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.
Related vulnerabilities in Zyxel
| CVE | Name | EPSS | Exploited |
|---|---|---|---|
| CVE-2020-9054 | Zyxel Multiple NAS Devices OS Command Injection Vulnerability | 100.0% | Yes |
| CVE-2022-30525 | Zyxel Multiple Firewalls OS Command Injection Vulnerability | 99.9% | Yes |
| CVE-2023-28771 | Zyxel Multiple Firewalls OS Command Injection Vulnerability | 99.3% | Yes |
| CVE-2017-18368 | Zyxel P660HN-T1A Routers Command Injection Vulnerability | 94.5% | Yes |
| CVE-2020-29583 | Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability | 90.0% | Yes |
| CVE-2023-27992 | Zyxel Multiple NAS Devices Command Injection Vulnerability | 84.2% | Yes |
| CVE-2017-6884 | Zyxel EMG2926 Routers Command Injection Vulnerability | 37.6% | Yes |
| CVE-2023-33010 | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | 28.8% | Yes |
Is your domain exposed?
Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.
Get your free reportAll information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.