Zyxel DSL CPE OS Command Injection (CVE-2024-40890)

Historical catalog analysis: CISA added this entry on February 11, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-40890 is an OS command injection vulnerability (CWE-78) affecting multiple Zyxel DSL CPE devices. The flaw exists within a CGI program, where a crafted HTTP request can be used to execute arbitrary operating system commands. This vulnerability requires the attacker to be authenticated to the device.

Exposure and applicability

This vulnerability applies to specific legacy Zyxel DSL CPE hardware. Because these devices may have reached end-of-life (EoL) or end-of-service (EoS) status, they may no longer receive security updates from the vendor. The exposure path is limited to authenticated users who can send malicious HTTP requests to the affected CGI program. Infrastructure owners should identify all deployed Zyxel DSL CPE assets and verify their current support status against vendor advisories to determine if they are susceptible.

Remediation priorities

Our analysis suggests that remediation for this vulnerability depends heavily on the support lifecycle of the hardware in use:

1. Asset Identification and Lifecycle Audit: Prioritize identifying all Zyxel DSL CPE devices across the environment. Determine which units are EoL or EoS, as these represent the highest risk due to the lack of available patches.
2. Decommissioning Legacy Hardware: For devices confirmed as EoL/EoS where no mitigation is provided by the vendor, our analysis recommends discontinuing product utilization and replacing the hardware with supported alternatives.
3. Access Control Hardening: Since this is a post-authentication vulnerability, reducing the number of users with administrative access to these devices could reduce the likelihood of exploitation while replacement hardware is sourced.

How to validate remediation

Verification must move beyond simple version checks, as EoL status implies that no newer version may exist to resolve the flaw.

• Decommissioning Evidence: The most reliable evidence of remediation for EoL assets is a documented decommissioning log and physical or logical removal of the device from the network.
• Configuration Audit: For devices remaining in service, verify that administrative access is restricted to a minimal set of authorized users via an audit of the local user database.

Limits and open questions

It remains unknown whether this vulnerability has been utilized by ransomware campaigns. Furthermore, because the source indicates these products may be EoL/EoS, there is a significant risk that no official patch exists for many affected models. This creates a residual risk where the only effective mitigation is total asset replacement. Defenders should assume that any device lacking a current vendor-supported mitigation remains fully exposed to authenticated command injection.

Source and editorial note

CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability · Source date: February 11, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 14, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 25, 2026 at 00:31 UTC.

Request a Vulnerability Assessment