CVE-2024-40890
Zyxel
CVE-2024-40890 is a command injection vulnerability affecting Zyxel VMG4325-B10A devices, potentially allowing attackers to execute OS commands. This post-authentication vulnerability resides in the CGI program of the legacy DSL CPE. Successful exploitation involves sending a crafted HTTP POST request after authentication. While the CVSS score is 0 because it's UNSUPPORTED WHEN ASSIGNED, active exploits are available, indicating a real-world threat. The SOCRadar Vulnerability Risk Score (SVRS) is 34, suggesting a moderate risk level despite the unsupported status and low CVSS, largely due to the existence of active exploits and its inclusion in CISA KEV. Organizations using the affected Zyxel devices should investigate and mitigate the potential for command injection attacks by looking into alternative firmwares or mitigations. This vulnerability is significant because even older, unsupported devices can pose a risk if left unpatched when actively exploited.
Description
CVE-2024-40890 is a post-authentication command injection vulnerability present in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615. This vulnerability allows an authenticated attacker to execute arbitrary operating system (OS) commands on an affected device by sending a specially crafted HTTP POST request.
While the CVSS score is 8.8, the SOCRadar Vulnerability Risk Score (SVRS) is 38, indicating a lower immediate threat level. However, the vulnerability is tagged as "In The Wild," meaning it is actively exploited by attackers. Therefore, immediate action is still critical to mitigate this risk.
Key Insights
- Remote Code Execution: The vulnerability allows an attacker to remotely execute arbitrary code on the affected device, potentially granting full control over the system.
- Authentication Bypass: The vulnerability requires authentication, implying the attacker has legitimate access to the device. However, the attack vector involves crafting a specific HTTP request, which could be utilized to bypass access controls or exploit weak authentication mechanisms.
- Legacy Firmware: The vulnerability impacts a legacy firmware version of the Zyxel VMG4325-B10A DSL CPE, indicating a potential risk for organizations still utilizing older or outdated devices.
- Active Exploitation: The "In The Wild" tag signifies that attackers are actively exploiting this vulnerability in real-world attacks. This underscores the urgency of applying mitigation measures to prevent successful exploitation.
Mitigation Strategies
- Firmware Update: Immediately update the firmware on all affected Zyxel VMG4325-B10A DSL CPE devices to a version that addresses the vulnerability.
- Network Segmentation: Isolate affected devices from critical networks to limit the potential impact of a successful exploit.
- Access Control: Implement strong access control measures to restrict access to the device's configuration interface and prevent unauthorized users from accessing it.
- Intrusion Detection/Prevention Systems (IDS/IPS): Configure IDS/IPS systems to detect and block potential malicious traffic associated with this vulnerability.
Additional Information
For further information or assistance regarding this incident, you can utilize the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.