CVE-2024-40890
⚠️ highSummary
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
CVSS Score
8.8
High
EPSS Score
13.0
Exploit Probability
Published Date
2025-02-04
First Seen: 2026-01-05
📊 Relative Risk Intelligence
This CVE is High Risk - more severe than 80.8% of all 365,968 vulnerabilities in our database.
#70,121
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Feb 11, 2025
🔍 Exploitation Status
Active
Exploits detected in the wild
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by
CISA
Last Modified
2025-10-27
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)