PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-40890 Zyxel CVE debrief

CVE-2024-40890 is a Zyxel DSL CPE OS command injection vulnerability that CISA added to the Known Exploited Vulnerabilities catalog on 2025-02-11. The KEV entry indicates the affected product may be end-of-life or end-of-service, and CISA advises discontinuing use of the product if a current mitigation is not available. Because this issue is already in KEV, defenders should treat it as an active risk indicator even though the source corpus here does not provide CVSS scoring or affected version details. The most important question is whether any Zyxel DSL CPE devices remain in service, especially legacy units that may not receive security fixes.

Vendor
Zyxel
Product
DSL CPE Devices
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-02-11
Original CVE updated
2025-02-11
Advisory published
2025-02-11
Advisory updated
2025-02-11

Who should care

Organizations that use Zyxel DSL CPE devices, especially legacy deployments, internet-facing edge devices, managed service providers, and asset owners responsible for aging networking hardware.

Technical summary

The available source material identifies an OS command injection vulnerability in Zyxel DSL CPE devices. The CISA KEV listing confirms the vulnerability is known to be exploited and notes the impacted product may be EoL/EoS. No version-specific exposure details or scoring were included in the supplied corpus.

Defensive priority

High. CISA has already placed the issue in the Known Exploited Vulnerabilities catalog, and the KEV note specifically warns that affected devices may be unsupported and require discontinuation if mitigation is unavailable.

Recommended defensive actions

  • Inventory all Zyxel DSL CPE devices in your environment and determine whether any are legacy or unsupported.
  • Review the vendor security advisories referenced by CISA for official mitigation or remediation guidance.
  • Apply any vendor-provided fix or configuration mitigation as soon as it is available and validated.
  • If no current mitigation exists and the device is EoL/EoS, discontinue use and plan replacement.
  • Prioritize any internet-exposed or otherwise high-reach devices for immediate review.
  • Track the CISA KEV due date of 2025-03-04 in remediation planning and exception management.

Evidence notes

This debrief is based only on the supplied CVE metadata, the CISA KEV record, and the official resource links provided in the corpus. The corpus confirms the CVE title, KEV inclusion date, due date, and CISA’s EoL/EoS warning. It does not include CVSS data, affected versions, exploit details, or parsed vendor advisory text, so those specifics are intentionally not asserted here.

Official resources

CISA added CVE-2024-40890 to the Known Exploited Vulnerabilities catalog on 2025-02-11, with a remediation due date of 2025-03-04. The supplied corpus cites official Zyxel security advisories in the KEV notes, but their contents were not re