PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-40890 Zyxel CVE debrief

CVE-2024-40890 is a Zyxel DSL CPE OS command injection vulnerability that CISA added to the Known Exploited Vulnerabilities catalog on 2025-02-11. The KEV entry indicates the affected product may be end-of-life or end-of-service, and CISA advises discontinuing use of the product if a current mitigation is not available. Because this issue is already in KEV, defenders should treat it as an active risk indicator even though the source corpus here does not provide CVSS scoring or affected version details. The most important question is whether any Zyxel DSL CPE devices remain in service, especially legacy units that may not receive security fixes.

Vendor
Zyxel
Product
DSL CPE Devices
CVSS
HIGH 8.8
CISA KEV
Listed
Original CVE published
2025-02-11
Original CVE updated
2025-02-11
Advisory published
2025-02-11
Advisory updated
2025-02-11

Who should care

Organizations that use Zyxel DSL CPE devices, especially legacy deployments, internet-facing edge devices, managed service providers, and asset owners responsible for aging networking hardware.

Technical summary

The available source material identifies an OS command injection vulnerability in Zyxel DSL CPE devices. The CISA KEV listing confirms the vulnerability is known to be exploited and notes the impacted product may be EoL/EoS. No version-specific exposure details or scoring were included in the supplied corpus.

Defensive priority

High. CISA has already placed the issue in the Known Exploited Vulnerabilities catalog, and the KEV note specifically warns that affected devices may be unsupported and require discontinuation if mitigation is unavailable.

Recommended defensive actions

  • Inventory all Zyxel DSL CPE devices in your environment and determine whether any are legacy or unsupported.
  • Review the vendor security advisories referenced by CISA for official mitigation or remediation guidance.
  • Apply any vendor-provided fix or configuration mitigation as soon as it is available and validated.
  • If no current mitigation exists and the device is EoL/EoS, discontinue use and plan replacement.
  • Prioritize any internet-exposed or otherwise high-reach devices for immediate review.
  • Track the CISA KEV due date of 2025-03-04 in remediation planning and exception management.

Evidence notes

This debrief is based only on the supplied CVE metadata, the CISA KEV record, and the official resource links provided in the corpus. The corpus confirms the CVE title, KEV inclusion date, due date, and CISA’s EoL/EoS warning. It does not include CVSS data, affected versions, exploit details, or parsed vendor advisory text, so those specifics are intentionally not asserted here.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-40890 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-40890

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-40890 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-40890

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.